Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Patched.24562.10289.exe

Overview

General Information

Sample name:SecuriteInfo.com.Win32.Patched.24562.10289.exe
Analysis ID:1505139
MD5:d430fb367b17fdd8a5f7fd72c16e0477
SHA1:bd832259a3dd2e8d0c4e421bdf92c0a7b06f9049
SHA256:3710df97f996f8f6390fa8b23bbafea03f2e7568bf00297f737324f380f06675
Tags:exe
Infos:

Detection

Score:45
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Generic Python Ransomware
Found Tor onion address
Found pyInstaller with non standard icon
Tries to steal Crypto Currency Wallets
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Win32.Patched.24562.10289.exe (PID: 7652 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe" MD5: D430FB367B17FDD8A5F7FD72C16E0477)
    • SecuriteInfo.com.Win32.Patched.24562.10289.exe (PID: 7948 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe" MD5: D430FB367B17FDD8A5F7FD72C16E0477)
      • cmd.exe (PID: 8100 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 8108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 8160 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 8168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 7268 cmdline: C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 7284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • fsutil.exe (PID: 5392 cmdline: fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1 MD5: 452CA7574A1B2550CD9FF83DDBE87463)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: SecuriteInfo.com.Win32.Patched.24562.10289.exe PID: 7948JoeSecurity_GenericPythonRansomwareYara detected Generic Python RansomwareJoe Security

    Sigma Signatures

    ⊘No Sigma rule has matched

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A69AA40 ?connectToHostEncrypted@QSslSocket@@QAEXABVQString@@G0V?$QFlags@W4OpenModeFlag@QIODevice@@@@W4NetworkLayerProtocol@QAbstractSocket@@@Z,?isWarningEnabled@QLoggingCategory@@QBE_NXZ,??0QMessageLogger@@QAE@PBDH00@Z,?warning@QMessageLogger@@QBAXPBDZZ,?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z,??1QString@@QAE@XZ,??4QString@@QAEAAV0@ABV0@@Z,?isWarningEnabled@QLoggingCategory@@QBE_NXZ,??0QMessageLogger@@QAE@PBDH00@Z,?warning@QMessageLogger@@QBAXPBDZZ,6_2_6A69AA40
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A69EA90 ??0GeneratorParameters@QDtlsClientVerifier@@QAE@W4Algorithm@QCryptographicHash@@ABVQByteArray@@@Z,??0QByteArray@@QAE@ABV0@@Z,6_2_6A69EA90
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A69AB60 ?connectToHostEncrypted@QSslSocket@@QAEXABVQString@@GV?$QFlags@W4OpenModeFlag@QIODevice@@@@W4NetworkLayerProtocol@QAbstractSocket@@@Z,?isWarningEnabled@QLoggingCategory@@QBE_NXZ,??0QMessageLogger@@QAE@PBDH00@Z,?warning@QMessageLogger@@QBAXPBDZZ,?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z,??1QString@@QAE@XZ,?isWarningEnabled@QLoggingCategory@@QBE_NXZ,??0QMessageLogger@@QAE@PBDH00@Z,?warning@QMessageLogger@@QBAXPBDZZ,6_2_6A69AB60
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6B8920 ?deriveKeyPbkdf2@QPasswordDigestor@@YA?AVQByteArray@@W4Algorithm@QCryptographicHash@@ABV2@1H_K@Z,?hashLength@QCryptographicHash@@SAHW4Algorithm@1@@Z,??0QMessageLogger@@QAE@PBDH0@Z,?warning@QMessageLogger@@QBE?AVQDebug@@XZ,??6QDebug@@QAEAAV0@PBD@Z,?qt_QMetaEnum_debugOperator@@YA?AVQDebug@@AAV1@HPBUQMetaObject@@PBD@Z,??1QDebug@@QAE@XZ,??1QDebug@@QAE@XZ,??6QDebug@@QAEAAV0@PBD@Z,??6QDebug@@QAEAAV0@_K@Z,??6QDebug@@QAEAAV0@PBD@Z,??6QDebug@@QAEAAV0@_K@Z,??6QDebug@@QAEAAV0@PBD@Z,??1QDebug@@QAE@XZ,??1QDebug@@QAE@XZ,??0QString@@QAE@XZ,??0QString@@QAE@XZ,??0QMessageAuthenticationCode@@QAE@W4Algorithm@QCryptographicHash@@ABVQByteArray@@@Z,??0QByteArray@@QAE@HW4Initialization@Qt@@@Z,?addData@QMessageAuthenticationCode@@QAEXABVQByteArray@@@Z,?result@QMessageAuthenticationCode@@QBE?AVQByteArray@@XZ,?reset@QMessageAuthenticationCode@@QAEXXZ,?addData@QMessageAuthenticationCode@@QAEXABVQByteArray@@@Z,?begin@QByteArray@@QAEPADXZ,?addData@QMessageAuthenticationCode@@QAEXABVQByteArray@@@Z,?result@QMessageAuthenticationCode@@QBE?AVQByteArray@@XZ,?reset@QMessageAuthenticationCode@@QAEXXZ,??0QByteArray@@QAE@ABV0@@Z,?addData@QMessageAuthenticationCode@@QAEXABVQByteArray@@@Z,?result@QMessageAuthenticationCode@@QBE?AVQByteArray@@XZ,??4QDateTime@@QAEAAV0@$$QAV0@@Z,??1QByteArray@@QAE@XZ,?reset@QMessageAuthenticationCode@@QAEXXZ,?begin@QByteArray@@QAEPADXZ,?data@QString@@QBEPBVQChar@@XZ,?cend@QByteArray@@QBEPBDXZ,?data@QString@@QBEPBVQChar@@XZ,?addData@QMessageAuthenticationCode@@QAEXABVQByteArray@@@Z,?result@QMessageAuthenticationCode@@QBE?AVQByteArray@@XZ,?reset@QMessageAuthenticationCode@@QAEXXZ,?append@QByteArray@@QAEAAV1@ABV1@@Z,??1QByteArray@@QAE@XZ,??1QByteArray@@QAE@XZ,?left@QByteArray@@QBE?AV1@H@Z,??1QByteArray@@QAE@XZ,??1QMessageAuthenticationCode@@QAE@XZ,??1QByteArray@@QAE@XZ,6_2_6A6B8920
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A69EED0 ?decryptDatagram@QDtls@@QAE?AVQByteArray@@PAVQUdpSocket@@ABV2@@Z,?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z,??4QString@@QAEAAV0@ABV0@@Z,??1QString@@QAE@XZ,??0QString@@QAE@XZ,?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z,6_2_6A69EED0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A634E90 ??0QUrl@@QAE@ABV0@@Z,??0QString@@QAE@XZ,?setPassword@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z,??1QString@@QAE@XZ,??0QString@@QAE@XZ,?setFragment@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z,??1QString@@QAE@XZ,??0QCryptographicHash@@QAE@W4Algorithm@0@@Z,?toEncoded@QUrl@@QBE?AVQByteArray@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z,?addData@QCryptographicHash@@QAEXABVQByteArray@@@Z,??1QByteArray@@QAE@XZ,?result@QCryptographicHash@@QBE?AVQByteArray@@XZ,?data@QString@@QBEPBVQChar@@XZ,?number@QByteArray@@SA?AV1@_JH@Z,?left@QByteArray@@QBE?AV1@H@Z,??1QByteArray@@QAE@XZ,??1QByteArray@@QAE@XZ,?at@QByteArray@@QBEDH@Z,?data@QString@@QBEPBVQChar@@XZ,?data@QString@@QBEPBVQChar@@XZ,?number@QString@@SA?AV1@IH@Z,??0QString@@QAE@HW4Initialization@Qt@@@Z,?data@QString@@QBEPBVQChar@@XZ,?data@QString@@QBEPBVQChar@@XZ,memmove,??0QChar@@QAE@UQLatin1Char@@@Z,?appendLatin1To@QAbstractConcatenable@@KAXPBDHPAVQChar@@@Z,?appendLatin1To@QAbstractConcatenable@@KAXPBDHPAVQChar@@@Z,??1QString@@QAE@XZ,??1QByteArray@@QAE@XZ,??1QCryptographicHash@@QAE@XZ,??1QUrl@@QAE@XZ,6_2_6A634E90
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A666C40 ?detach@QAuthenticator@@QAEXXZ,??0QString@@QAE@XZ,??0QString@@QAE@XZ,??0QString@@QAE@XZ,?shared_null@QHashData@@2U1@B,??0QString@@QAE@XZ,??0QString@@QAE@XZ,??0QString@@QAE@XZ,??0QString@@QAE@XZ,??0QString@@QAE@XZ,?system@QRandomGenerator64@@SAPAV1@XZ,?_fillRange@QRandomGenerator@@AAEXPAX0@Z,?number@QByteArray@@SA?AV1@_KH@Z,?hash@QCryptographicHash@@SA?AVQByteArray@@ABV2@W4Algorithm@1@@Z,?toHex@QByteArray@@QBE?AV1@XZ,??4QDateTime@@QAEAAV0@$$QAV0@@Z,??1QByteArray@@QAE@XZ,??1QByteArray@@QAE@XZ,??1QByteArray@@QAE@XZ,6_2_6A666C40
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A69E240 ?waitForReadyRead@QSslSocket@@UAE_NH@Z,?start@QElapsedTimer@@QAEXXZ,?waitForEncrypted@QSslSocket@@QAE_NH@Z,?elapsed@QElapsedTimer@@QBE_JXZ,?qt_subtract_from_timeout@@YAHHH@Z,6_2_6A69E240
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A616370 ?encrypted@QNetworkAccessManager@@QAEXPAVQNetworkReply@@@Z,?staticMetaObject@QNetworkAccessManager@@2UQMetaObject@@B,?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z,6_2_6A616370
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A69E130 ?waitForEncrypted@QSslSocket@@QAE_NH@Z,?start@QElapsedTimer@@QAEXXZ,?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ,?startClientEncryption@QSslSocket@@QAEXXZ,?elapsed@QElapsedTimer@@QBE_JXZ,?qt_subtract_from_timeout@@YAHHH@Z,6_2_6A69E130
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\LICENSE.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\revealer\LICENSE_DEJAVU.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\revealer\SIL Open Font License.txtJump to behavior
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic PE information: certificate valid
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354565423.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355359672.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2589869938.00000000695B3000.00000002.00000001.01000000.00000035.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354396146.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_wasapi.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_wasapi.pdb++" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\printsupport\windowsprintersupport.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_decimal.pdb%% source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2598818140.000000006C9E2000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354975105.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592034048.0000000069624000.00000002.00000001.01000000.00000033.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\qtmedia_audioengine.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356563460.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb''! source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592425928.0000000069656000.00000002.00000001.01000000.00000030.sdmp
    Source: Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2595934639.000000006BA71000.00000020.00000001.01000000.00000022.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2588912454.0000000069587000.00000002.00000001.01000000.00000036.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb!! source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354700958.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2602297206.000000006FF65000.00000002.00000001.01000000.00000031.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592425928.0000000069656000.00000002.00000001.01000000.00000030.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356040749.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2586346848.00000000694C7000.00000002.00000001.01000000.0000003A.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\pyexpat.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2600737267.000000006CD4F000.00000002.00000001.01000000.0000000E.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_windows.pdb(( source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2600125221.000000006CC34000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_bz2.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2601200333.000000006CDBC000.00000002.00000001.01000000.0000000A.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354257486.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_asyncio.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2599586764.000000006CA17000.00000002.00000001.01000000.00000013.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2584872500.0000000005317000.00000002.00000001.01000000.00000025.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libGLESv2.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592816487.000000006A00B000.00000002.00000001.01000000.0000002F.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_socket.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2600875298.000000006CD68000.00000002.00000001.01000000.0000000C.sdmp
    Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:35 2023 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not available source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2600125221.000000006CC34000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\qtmedia_audioengine.pdb-- source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356563460.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libGLESv2.pdb3 source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592816487.000000006A00B000.00000002.00000001.01000000.0000002F.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\msvcp140_1.i386.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2595834503.000000006BA61000.00000020.00000001.01000000.00000021.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354700958.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2602297206.000000006FF65000.00000002.00000001.01000000.00000031.sdmp
    Source: Binary string: d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2602514838.0000000073C61000.00000020.00000001.01000000.00000006.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\printsupport\windowsprintersupport.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_queue.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2600593933.000000006CD23000.00000002.00000001.01000000.0000000F.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355499153.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\playlistformats\qtmultimedia_m3u.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358443027.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354257486.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\sqlite3.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597097623.000000006C301000.00000002.00000001.01000000.0000001E.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_sqlite3.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597240669.000000006C339000.00000002.00000001.01000000.0000001D.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354837544.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\lib\Qt5Multimedia.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2593981924.000000006A76A000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2599790827.000000006CA82000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354975105.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592034048.0000000069624000.00000002.00000001.01000000.00000033.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\python3.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2586182529.0000000010000000.00000002.00000001.01000000.00000007.sdmp
    Source: Binary string: D:\a\1\b\libssl-1_1.pdbAA source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2599790827.000000006CA82000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354396146.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_decimal.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2598818140.000000006C9E2000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_hashlib.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2599065056.000000006C9F5000.00000002.00000001.01000000.00000015.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdbTT source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355125664.00000000024EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2590911263.0000000069616000.00000002.00000001.01000000.00000034.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb,, source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2588912454.0000000069587000.00000002.00000001.01000000.00000036.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2594610201.000000006AB31000.00000002.00000001.01000000.00000027.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_windows.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2593243825.000000006A526000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355125664.00000000024EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2590911263.0000000069616000.00000002.00000001.01000000.00000034.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355850762.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2586624372.00000000694E3000.00000002.00000001.01000000.00000039.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1335239147.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_00408F20 FindFirstFileExW,FindClose,1_2_00408F20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_00408F20 FindFirstFileExW,FindClose,6_2_00408F20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\Jump to behavior

    Networking

    barindex
    Found Tor onion address
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583816893.0000000004500000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: This lnurl callback_url looks unsafe. It must use 'https://' or '.onion' (found:
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583816893.0000000004500000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: This lnurl looks unsafe. It must use 'https://' or '.onion' (found:
    Source: unknownDNS traffic detected: query: 15.164.165.52.in-addr.arpa replaycode: Name error (3)
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A68EA90 WSARecvFrom,WSAGetLastError,?clear@QHostAddress@@QAEXXZ,?clear@QHostAddress@@QAEXXZ,?setAddress@QHostAddress@@QAEXPBE@Z,?number@QString@@SA?AV1@IH@Z,?setScopeId@QHostAddress@@QAEXABVQString@@@Z,??1QString@@QAE@XZ,WSANtohl,?setAddress@QHostAddress@@QAEXI@Z,6_2_6A68EA90
    Source: global trafficDNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582930312.0000000003EC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeString found in binary or memory: http://bugreports.qt.io/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581400054.00000000034B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://bugs.python.org/issue1230540
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1323649307.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357348485.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1329348310.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355850762.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330180278.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356378009.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355850762.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355896087.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356295590.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330347814.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357048693.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355535600.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358330012.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1323649307.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357348485.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1329348310.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356378009.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330364230.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355896087.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCj
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCjj
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1507845690.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1517934638.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1511578157.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591851264.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1506693280.0000000002D0B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523574953.000000000087F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1506942500.0000000000880000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1506693280.0000000002D0B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1506778070.0000000002D17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1506079847.0000000002C6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355850762.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356378009.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330364230.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355896087.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357048693.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355535600.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358330012.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358479839.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1323649307.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357348485.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1329348310.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330180278.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356378009.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330364230.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1329348310.00000000024E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-a
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1329367094.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-aj
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1329367094.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-ajj
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355850762.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330180278.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355896087.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356295590.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330347814.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357048693.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355535600.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1323649307.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357348485.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1329348310.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356378009.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330364230.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355896087.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1323649307.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357348485.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1329348310.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355850762.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330180278.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356378009.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355850762.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330180278.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355896087.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356295590.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330347814.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357048693.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355535600.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1323649307.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357348485.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1329348310.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356378009.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330364230.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355896087.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1462886230.00000000024E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dejavu.sourceforge.net/wiki/index.php/License
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1462886230.00000000024E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dejavu.sourceforge.net/wiki/index.php/Licensehttp://dejavu.sourceforge.net/wiki/index.php/Lic
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585374931.0000000005920000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.electrum.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591510660.0000000003A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.electrum.org/r
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580764662.0000000003200000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581260816.0000000003400000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1507337416.0000000000888000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580714723.00000000031B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1508291858.0000000002D2E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580653016.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/ActiveState/appdirs
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583962274.0000000004600000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2584035611.00000000046A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/romanz/amodem/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583962274.0000000004600000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/romanz/amodem/;
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1528642852.000000000392A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000003132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003145000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/post
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1458408323.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1459591765.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1460708940.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1462243863.00000000024E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1462243863.00000000024E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1459591765.00000000024E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1458408323.00000000024E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bol
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1460708940.00000000024E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fw
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mynode.local:3002/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1323649307.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357348485.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1329348310.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355850762.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330180278.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356378009.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355850762.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355896087.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356295590.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330347814.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357048693.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355535600.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358330012.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1323649307.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357348485.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1329348310.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356378009.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330364230.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355896087.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498473286.0000000002CFC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498189548.0000000002CFC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498239523.000000000081D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2579837855.0000000002E60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581716829.0000000003690000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://python.org
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000003132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003145000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://python.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581716829.0000000003690000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://python.org:80
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583816893.0000000004500000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/5176691/argparse-how-to-specify-a-default-subcommand
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000039BB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/5176691/argparse-how-to-specify-a-default-subcommandFr
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2579837855.0000000002E60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000003132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.0000000003122000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://unicode.org/reports/tr46/).
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2584872500.0000000005317000.00000002.00000001.01000000.00000025.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/id/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498473286.0000000002CFC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498189548.0000000002CFC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498239523.000000000081D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2579888959.0000000002EA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498473286.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498473286.0000000002C6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2584872500.0000000005317000.00000002.00000001.01000000.00000025.sdmpString found in binary or memory: http://www.color.org)
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000002F89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comhttp://www.fontbureau.com/designersCursivaHigh
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.0000000003A18000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comhttp://www.fontbureau.com/designersNormalNormaaliNormalNorm
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524643453.00000000030C9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591376227.0000000003051000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591899706.0000000003051000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.000000000305D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498473286.0000000002CEC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Microsoft
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581400054.00000000034B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.lincolnloop.com
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582966655.0000000003F00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.nightmare.com/squirl/python-ext/misc/syslog.py
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353714154.00000000024E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.openssl.org/V
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498473286.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498473286.0000000002C6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://yahoo.com/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://3xpl.com/bitcoin/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583594237.0000000004360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.trustedcoin.com/#/electrum-help
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585521218.0000000005A20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.trustedcoin.com/2/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.0000000003AAE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.trustedcoin.com/2/c
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blockchain.com/btc/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blockchair.com/bitcoin/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blockstream.info/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581646325.0000000003600000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blockstream.info/testnet/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://btc.bitaps.com/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://btc.bitaps.com/r
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://btc.com/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue37179
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581400054.00000000034B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue42130
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597512220.000000006C39A000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chainflyer.bitflyer.jp/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581827621.0000000003750000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cloud.google.com/appengine/docs/standard/runtimes
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585411153.0000000005960000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crashhub.electrum.org
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582930312.0000000003EC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583740593.0000000004480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-config
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583740593.0000000004480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-configG
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1528335797.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581863026.00000000037A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2579405117.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2579405117.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1517242856.0000000002FD3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1521036439.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523647364.0000000002FC2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524685226.000000000305D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2579950912.0000000002EE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1517734718.0000000003022000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1517242856.0000000002FD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581898769.00000000037E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585374931.0000000005920000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582966655.0000000003F00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591510660.0000000003A78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://electrum.org
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000039BB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://electrum.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585484853.00000000059E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://electrum.org/#download
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585484853.00000000059E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://electrum.org/version
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585484853.00000000059E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://electrum.org/versionr
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581646325.0000000003600000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ex.signet.bublina.eu.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://explorer.bc-2.jp/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580653016.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581827621.0000000003750000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581754093.00000000036D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585484853.00000000059E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ColinDuquesnoy/QDarkStyleSheet/issues/200
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1493848215.0000000000827000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1493284127.00000000001FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492241928.0000000000803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1499177635.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491385442.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498239523.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490197089.0000000002456000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490308483.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491802301.0000000000803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490894645.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491504814.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1497647994.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492512320.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498042646.000000000081E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1494521580.000000000082E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582893667.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582966655.0000000003F00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/bitcoin-core/HWI/blob/5f300d3dee7b317a6194680ad293eaa0962a3cc7/hwilib/key.py
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582930312.0000000003EC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/bitcoin/bitcoin/blob/8cbc5c4be4be22aca228074f087a374a7ec38be8/src/script/script.h
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583112619.0000000004010000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/bitcoin/bitcoin/blob/master/src/script/descriptor.cpp
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583002832.0000000003F40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/btcsuite/btcd/blob/fdc2bc867bda6b351191b5872d2da8270df00d13/txscript/scriptbuilde
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583999285.0000000004660000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/digitalbitbox/bitbox02-firmware/tree/master/py/bitbox02
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583703354.0000000004440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/fiatjaf/lnurl-rfc/blob/luds/16.md
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2579888959.0000000002EA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583039420.0000000003F80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/keis/base58
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583076129.0000000003FC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580714723.00000000031B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1520553340.000000000300B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000003132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524269615.0000000003135000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003145000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/136
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000003132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524269615.0000000003135000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003145000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/428
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490197089.0000000002456000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1494521580.000000000082E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1493848215.0000000000827000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1493284127.00000000001FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492241928.0000000000803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1499177635.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491385442.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498239523.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490197089.0000000002456000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490308483.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491802301.0000000000803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490894645.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491504814.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1497647994.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492512320.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498042646.000000000081E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1494521580.000000000082E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581400054.00000000034B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86296
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/pull/28073
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581827621.0000000003750000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581573254.0000000003580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/romis2012/aiohttp-socks/issues/27
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581863026.00000000037A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/romis2012/python-socks
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583853520.0000000004540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/satoshilabs/slips/blob/master/slip-0039.md.
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583039420.0000000003F80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/spesmilo/electrum
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583039420.0000000003F80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/spesmilo/electrum/issues
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583225136.00000000040D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/stefankoegl/python-json-patch
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583225136.00000000040D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/stefankoegl/python-json-patchng
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1493848215.0000000000827000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1493284127.00000000001FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492241928.0000000000803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1499177635.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491385442.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498239523.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490197089.0000000002456000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490308483.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491802301.0000000000803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490894645.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491504814.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1497647994.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492512320.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498042646.000000000081E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1494521580.000000000082E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000003132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003145000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582757109.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1528642852.000000000392A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/497
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003163000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003163000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://insight.bitpay.com/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524685226.000000000305D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://live.blockcypher.com/btc-testnet/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581646325.0000000003600000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://live.blockcypher.com/btc/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1528335797.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492947254.0000000000800000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524341335.00000000030E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.00000000030F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mempool.emzy.de/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mempool.space/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mempool.space/signet/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mempool.space/testnet/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mempool.space/x
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://oxt.me/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580653016.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003163000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003163000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582930312.0000000003EC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1497759033.0000000002C94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1497458279.0000000002C7D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581646325.0000000003600000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signet-explorer.wakiyamap.dev/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581646325.0000000003600000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signet.bitcoinexplorer.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524341335.00000000030E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581573254.0000000003580000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581400054.00000000034B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/a/13624858
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1517734718.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523647364.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591376227.0000000003051000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1517734718.0000000003022000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1521292676.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591899706.0000000003051000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1517242856.0000000002FD3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1521036439.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523647364.0000000002FC2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524685226.000000000305D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tbtc.bitaps.com/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581646325.0000000003600000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://testnet.smartbit.com.au/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003163000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003163000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583002832.0000000003F40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5155#section-5
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582757109.0000000003D30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582757109.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582720835.0000000003CF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/html/sec-forms.html#multipart-form-data
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1508291858.0000000002D2E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523574953.000000000087F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000003132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524269615.0000000003135000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003145000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.python.org/moin/DunderAlias
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581791806.0000000003710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581646325.0000000003600000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.blockchain.com/btc-testnet/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.blockonomics.co/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.chain.so/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1336737782.00000000024E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.6T6X6
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1331062848.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354420059.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1323649307.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357348485.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327288411.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354993131.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1329348310.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355850762.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327269550.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330180278.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1325816040.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358579533.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356582327.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355170283.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356378009.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1336782875.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.j
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1336782875.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.jj
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003163000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003163000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1528335797.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492947254.0000000000800000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524341335.00000000030E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.00000000030F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578984098.0000000002B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0205/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578984098.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491719086.0000000000841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591376227.0000000003051000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591899706.0000000003051000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.000000000305D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://zopeinterface.readthedocs.io/en/latest/

    Spam, unwanted Advertisements and Ransom Demands

    barindex
    Yara detected Generic Python Ransomware
    Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Win32.Patched.24562.10289.exe PID: 7948, type: MEMORYSTR
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_004099491_2_00409949
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_004131C01_2_004131C0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_00410A201_2_00410A20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_004145701_2_00414570
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_004095E61_2_004095E6
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_004095E61_2_004095E6
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_0040A6701_2_0040A670
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_0040AF901_2_0040AF90
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_004099496_2_00409949
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_004131C06_2_004131C0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_00410A206_2_00410A20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_004145706_2_00414570
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_004095E66_2_004095E6
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_004095E66_2_004095E6
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_0040A6706_2_0040A670
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_0040AF906_2_0040AF90
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_04FBB4F06_2_04FBB4F0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_0505AC706_2_0505AC70
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_04FBD1B06_2_04FBD1B0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_051228906_2_05122890
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_0505AB206_2_0505AB20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_050D93906_2_050D9390
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_050283B06_2_050283B0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_05024A806_2_05024A80
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695D79306_2_695D7930
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695E38206_2_695E3820
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695ED0906_2_695ED090
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695D80A06_2_695D80A0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695C15606_2_695C1560
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695C2D806_2_695C2D80
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695ED4C06_2_695ED4C0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695CCF366_2_695CCF36
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A638A506_2_6A638A50
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A66ABF06_2_6A66ABF0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A64AC706_2_6A64AC70
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A642D306_2_6A642D30
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6360706_2_6A636070
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: String function: 00402F90 appears 214 times
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: String function: 00402ED0 appears 132 times
    Source: _overlapped.pyd.1.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
    Source: unicodedata.pyd.1.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
    Source: libzbar-0.dll.1.drStatic PE information: Number of sections : 11 > 10
    Source: libusb-1.0.dll.1.drStatic PE information: Number of sections : 11 > 10
    Source: python3.dll.1.drStatic PE information: No import functions for PE file found
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353714154.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamessleay32.dllH vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtaudio_wasapi.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1328851196.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5QmlModels.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357348485.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqoffscreen.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtaudio_windows.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355850762.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwbmp.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1322886977.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140_1.dllT vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewindowsprintersupport.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330180278.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Svg.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqxdgdesktopportal.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1324867978.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5DBus.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1322640578.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dllT vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356295590.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedsengine.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1330347814.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5WebSockets.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358330012.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqxdgdesktopportal.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357624359.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwebgl.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355640405.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtiff.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354863666.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqicns.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354975105.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqico.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1327561232.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5PrintSupport.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358443027.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtmultimedia_m3u.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354396146.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtuiotouchplugin.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356563460.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtmedia_audioengine.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1335273224.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibEGL.dll. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358679724.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwindowsvistastyle.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356803857.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewmfengine.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354565423.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvgicon.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354700958.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqgif.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355499153.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtga.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354837544.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqicns.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1357030922.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqminimal.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1335239147.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibEGL.dll. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356040749.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwebp.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355359672.00000000024E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvg.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeBinary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2586182529.0000000010000000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2600793966.000000006CD57000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2596007447.000000006BADB000.00000002.00000001.01000000.00000022.sdmpBinary or memory string: OriginalFilenamemsvcp140.dllT vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2601261514.000000006CDC0000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2593392537.000000006A570000.00000002.00000001.01000000.0000002C.sdmpBinary or memory string: OriginalFilenameqwindows.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597157942.000000006C31A000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585118457.0000000005533000.00000002.00000001.01000000.00000025.sdmpBinary or memory string: OriginalFilenameQt5Gui.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2602351901.000000006FF68000.00000002.00000001.01000000.00000031.sdmpBinary or memory string: OriginalFilenameqgif.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592311313.0000000069639000.00000002.00000001.01000000.00000032.sdmpBinary or memory string: OriginalFilenameqicns.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2602569991.0000000073C71000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2591629140.000000006961B000.00000002.00000001.01000000.00000034.sdmpBinary or memory string: OriginalFilenameqjpeg.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2586830831.00000000694E6000.00000002.00000001.01000000.00000039.sdmpBinary or memory string: OriginalFilenameqwbmp.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2588229485.0000000069556000.00000002.00000001.01000000.00000037.sdmpBinary or memory string: OriginalFilenameqtga.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592509324.000000006965F000.00000002.00000001.01000000.00000030.sdmpBinary or memory string: OriginalFilenameqwindowsvistastyle.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.0000000003B73000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameD3D10Warp.dllj% vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2587309842.0000000069544000.00000002.00000001.01000000.00000038.sdmpBinary or memory string: OriginalFilenameqtiff.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2601827179.000000006D1CC000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamepython310.dll. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2602215425.000000006EC17000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2586443101.00000000694D4000.00000002.00000001.01000000.0000003A.sdmpBinary or memory string: OriginalFilenameqwebp.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2594049092.000000006A7AB000.00000002.00000001.01000000.00000029.sdmpBinary or memory string: OriginalFilenameQt5Multimedia.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2600510142.000000006CD0F000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2599685800.000000006CA1C000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2593098527.000000006A093000.00000002.00000001.01000000.0000002F.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dll4 vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2600932143.000000006CD6F000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2601973308.000000006E926000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597295354.000000006C33F000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2602461223.000000006FF76000.00000002.00000001.01000000.0000002E.sdmpBinary or memory string: OriginalFilenamelibEGL.dll. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2601109898.000000006CDA2000.00000002.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2594793727.000000006AC96000.00000002.00000001.01000000.00000027.sdmpBinary or memory string: OriginalFilenameQt5Widgets.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592144411.0000000069628000.00000002.00000001.01000000.00000033.sdmpBinary or memory string: OriginalFilenameqico.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpBinary or memory string: OriginalFilenameQt5Network.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED
    Source: Qt5Core.dll.1.drStatic PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
    Source: libsecp256k1-2.dll.1.drStatic PE information: Section: .rdata ZLIB complexity 0.9982626488095238
    Source: classification engineClassification label: mal45.rans.spyw.evad.winEXE@14/874@1/1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_004086F0 FormatMessageW,WideCharToMultiByte,GetLastError,1_2_004086F0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6B23B0 ?shared_null@QListData@@2UData@1@B,CertOpenSystemStoreW,CertFindCertificateInStore,CertFindCertificateInStore,??0QByteArray@@QAE@PBDH@Z,??0QSslCertificate@@QAE@ABVQByteArray@@W4EncodingFormat@QSsl@@@Z,??0QSslCertificate@@QAE@ABV0@@Z,??0QSslCertificate@@QAE@ABV0@@Z,?append@QListData@@QAEPAPAXXZ,??1QSslCertificate@@QAE@XZ,??1QByteArray@@QAE@XZ,CertFindCertificateInStore,CertCloseStore,6_2_6A6B23B0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Roaming\ElectrumJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeMutant created: NULL
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8108:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7284:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8168:120:WilError_03
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user~1\AppData\Local\Temp\_MEI76522Jump to behavior
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597097623.000000006C301000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597097623.000000006C301000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597097623.000000006C301000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597097623.000000006C301000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597097623.000000006C301000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597097623.000000006C301000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597097623.000000006C301000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\fsutil.exe fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\fsutil.exe fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: vcruntime140.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: libffi-7.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: libcrypto-1_1.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: libssl-1_1.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: hid.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: sqlite3.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: qt5core.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: netapi32.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: winmm.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: msvcp140.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: msvcp140_1.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: qt5gui.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: d3d11.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dxgi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: qt5widgets.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dwmapi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: qt5multimedia.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: qt5network.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: qt5network.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: wtsapi32.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: d3d9.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: d3d10warp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: opengl32.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: glu32.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: appxdeploymentclient.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: libegl.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: libglesv2.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dcomp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: resourcepolicyclient.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: d3d10warp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dxcore.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: qt5svg.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dwrite.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dataexchange.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: twinapi.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: textinputframework.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: coreuicomponents.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: coremessaging.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\Desktop\pyvenv.cfgJump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic PE information: certificate valid
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic file information: File size 47764104 > 1048576
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354565423.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355359672.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2589869938.00000000695B3000.00000002.00000001.01000000.00000035.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354396146.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_wasapi.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_wasapi.pdb++" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353935513.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\printsupport\windowsprintersupport.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_decimal.pdb%% source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2598818140.000000006C9E2000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354975105.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592034048.0000000069624000.00000002.00000001.01000000.00000033.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\qtmedia_audioengine.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356563460.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb''! source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592425928.0000000069656000.00000002.00000001.01000000.00000030.sdmp
    Source: Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2595934639.000000006BA71000.00000020.00000001.01000000.00000022.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2588912454.0000000069587000.00000002.00000001.01000000.00000036.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb!! source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354700958.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2602297206.000000006FF65000.00000002.00000001.01000000.00000031.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592425928.0000000069656000.00000002.00000001.01000000.00000030.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356040749.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2586346848.00000000694C7000.00000002.00000001.01000000.0000003A.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\pyexpat.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2600737267.000000006CD4F000.00000002.00000001.01000000.0000000E.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_windows.pdb(( source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2600125221.000000006CC34000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_bz2.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2601200333.000000006CDBC000.00000002.00000001.01000000.0000000A.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354257486.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_asyncio.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2599586764.000000006CA17000.00000002.00000001.01000000.00000013.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2584872500.0000000005317000.00000002.00000001.01000000.00000025.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libGLESv2.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592816487.000000006A00B000.00000002.00000001.01000000.0000002F.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_socket.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2600875298.000000006CD68000.00000002.00000001.01000000.0000000C.sdmp
    Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:35 2023 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not available source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2600125221.000000006CC34000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\qtmedia_audioengine.pdb-- source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1356563460.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libGLESv2.pdb3 source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592816487.000000006A00B000.00000002.00000001.01000000.0000002F.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358309816.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\msvcp140_1.i386.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2595834503.000000006BA61000.00000020.00000001.01000000.00000021.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354700958.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2602297206.000000006FF65000.00000002.00000001.01000000.00000031.sdmp
    Source: Binary string: d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2602514838.0000000073C61000.00000020.00000001.01000000.00000006.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\printsupport\windowsprintersupport.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358561580.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_queue.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2600593933.000000006CD23000.00000002.00000001.01000000.0000000F.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355499153.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\playlistformats\qtmultimedia_m3u.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1358443027.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354257486.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\sqlite3.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597097623.000000006C301000.00000002.00000001.01000000.0000001E.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_sqlite3.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597240669.000000006C339000.00000002.00000001.01000000.0000001D.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354837544.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\lib\Qt5Multimedia.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2593981924.000000006A76A000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2599790827.000000006CA82000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354975105.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2592034048.0000000069624000.00000002.00000001.01000000.00000033.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\python3.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2586182529.0000000010000000.00000002.00000001.01000000.00000007.sdmp
    Source: Binary string: D:\a\1\b\libssl-1_1.pdbAA source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2599790827.000000006CA82000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354396146.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_decimal.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2598818140.000000006C9E2000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_hashlib.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2599065056.000000006C9F5000.00000002.00000001.01000000.00000015.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdbTT source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355125664.00000000024EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2590911263.0000000069616000.00000002.00000001.01000000.00000034.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb,, source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2588912454.0000000069587000.00000002.00000001.01000000.00000036.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2594610201.000000006AB31000.00000002.00000001.01000000.00000027.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_windows.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1354117294.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2593243825.000000006A526000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355125664.00000000024EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2590911263.0000000069616000.00000002.00000001.01000000.00000034.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1355850762.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2586624372.00000000694E3000.00000002.00000001.01000000.00000039.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1335239147.00000000024E6000.00000004.00000020.00020000.00000000.sdmp
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_004014F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,1_2_004014F0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic PE information: section name: /4
    Source: MSVCP140.dll.1.drStatic PE information: section name: .didat
    Source: Qt5Core.dll.1.drStatic PE information: section name: .qtmimed
    Source: opengl32sw.dll.1.drStatic PE information: section name: _RDATA
    Source: qtaudio_wasapi.dll.1.drStatic PE information: section name: .qtmetad
    Source: qtaudio_windows.dll.1.drStatic PE information: section name: .qtmetad
    Source: qgenericbearer.dll.1.drStatic PE information: section name: .qtmetad
    Source: qtuiotouchplugin.dll.1.drStatic PE information: section name: .qtmetad
    Source: qsvgicon.dll.1.drStatic PE information: section name: .qtmetad
    Source: qgif.dll.1.drStatic PE information: section name: .qtmetad
    Source: qicns.dll.1.drStatic PE information: section name: .qtmetad
    Source: qico.dll.1.drStatic PE information: section name: .qtmetad
    Source: qjpeg.dll.1.drStatic PE information: section name: .qtmetad
    Source: qsvg.dll.1.drStatic PE information: section name: .qtmetad
    Source: qtga.dll.1.drStatic PE information: section name: .qtmetad
    Source: qtiff.dll.1.drStatic PE information: section name: .qtmetad
    Source: qwbmp.dll.1.drStatic PE information: section name: .qtmetad
    Source: qwebp.dll.1.drStatic PE information: section name: .qtmetad
    Source: dsengine.dll.1.drStatic PE information: section name: .qtmetad
    Source: qtmedia_audioengine.dll.1.drStatic PE information: section name: .qtmetad
    Source: wmfengine.dll.1.drStatic PE information: section name: .qtmetad
    Source: qminimal.dll.1.drStatic PE information: section name: .qtmetad
    Source: qoffscreen.dll.1.drStatic PE information: section name: .qtmetad
    Source: qwebgl.dll.1.drStatic PE information: section name: .qtmetad
    Source: qwindows.dll.1.drStatic PE information: section name: .qtmetad
    Source: qxdgdesktopportal.dll.1.drStatic PE information: section name: .qtmetad
    Source: qtmultimedia_m3u.dll.1.drStatic PE information: section name: .qtmetad
    Source: windowsprintersupport.dll.1.drStatic PE information: section name: .qtmetad
    Source: qwindowsvistastyle.dll.1.drStatic PE information: section name: .qtmetad
    Source: libcrypto-1_1.dll.1.drStatic PE information: section name: .00cfg
    Source: libsecp256k1-2.dll.1.drStatic PE information: section name: /4
    Source: libssl-1_1.dll.1.drStatic PE information: section name: .00cfg
    Source: libusb-1.0.dll.1.drStatic PE information: section name: /4
    Source: libzbar-0.dll.1.drStatic PE information: section name: /4
    Source: python310.dll.1.drStatic PE information: section name: PyRuntim
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_004208BF push 41100E0Ah; ret 1_2_004208E0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_0041B970 push ds; ret 1_2_0041B978
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_0041C3EB push ebx; iretd 1_2_0041C470
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_0041C467 push ebx; iretd 1_2_0041C470
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_004208BF push 41100E0Ah; ret 6_2_004208E0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_0041B970 push ds; ret 6_2_0041B978
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_0041C3EB push ebx; iretd 6_2_0041C470
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_0041C467 push ebx; iretd 6_2_0041C470
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695F0556 push ecx; ret 6_2_695F0569
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8A6B push FFFFFF8Bh; iretd 6_2_6A6A8A73
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8A34 push 8B6A6D37h; iretd 6_2_6A6A8A3C
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8ADF push FFFFFF8Bh; iretd 6_2_6A6A8AE1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8AA8 push FFFFFF8Bh; iretd 6_2_6A6A8AAA
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8B7E push FFFFFF8Bh; iretd 6_2_6A6A8B86
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8B47 push FFFFFF8Bh; iretd 6_2_6A6A8B4F
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8B10 push FFFFFF8Bh; iretd 6_2_6A6A8B18
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8BE8 push FFFFFF8Bh; iretd 6_2_6A6A8BF4
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8BB5 push FFFFFF8Bh; iretd 6_2_6A6A8BBD
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8870 push FFFFFF8Bh; iretd 6_2_6A6A8884
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A884B push FFFFFF8Bh; iretd 6_2_6A6A884D
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A880E push FFFFFF8Bh; iretd 6_2_6A6A8816
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A88DA push FFFFFF8Bh; iretd 6_2_6A6A88F2
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A88A3 push FFFFFF8Bh; iretd 6_2_6A6A88BB
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8948 push FFFFFF8Bh; iretd 6_2_6A6A8960
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8911 push FFFFFF8Bh; iretd 6_2_6A6A8929
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A89FD push FFFFFF8Bh; iretd 6_2_6A6A8A05
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A89C6 push FFFFFF8Bh; iretd 6_2_6A6A89CE
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8995 push FFFFFF8Bh; iretd 6_2_6A6A8997
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A6E6D push FFFFFF8Bh; iretd 6_2_6A6A6E85
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A8E70 push FFFFFF8Bh; iretd 6_2_6A6A8E88
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6A6E42 push FFFFFF8Bh; iretd 6_2_6A6A6E4E

    Persistence and Installation Behavior

    barindex
    Found pyInstaller with non standard icon
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5DBus.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qwebp.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtPrintSupport.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\sip.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qwbmp.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Gui.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qgif.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\d3dcompiler_47.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qtga.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtWidgets.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_lzma.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\python310.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Core.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\libffi-7.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\cryptography\hazmat\bindings\_rust.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtCore.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtGui.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_decimal.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\select.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_multiprocessing.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_ctypes.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\MSVCP140_1.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qtiff.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Widgets.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\libzbar-0.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_hashlib.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_socket.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qsvg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_bz2.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qwebgl.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\printsupport\windowsprintersupport.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\libusb-1.0.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\pyexpat.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtNetwork.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\opengl32sw.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtMultimedia.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5QmlModels.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Multimedia.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\libssl-1_1.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\libEGL.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\python3.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qico.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qjpeg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qminimal.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_uuid.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\mediaservice\wmfengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Network.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\unicodedata.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Quick.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_overlapped.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\sqlite3.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\bearer\qgenericbearer.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5WebSockets.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\libGLESv2.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_asyncio.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qicns.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qoffscreen.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\mediaservice\qtmedia_audioengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\audio\qtaudio_wasapi.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\libeay32.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\VCRUNTIME140.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qwindows.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\libsecp256k1-2.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5PrintSupport.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Qml.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_sqlite3.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\playlistformats\qtmultimedia_m3u.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_ssl.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\ssleay32.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\iconengines\qsvgicon.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\mediaservice\dsengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\hid.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\libcrypto-1_1.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\MSVCP140.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Svg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\audio\qtaudio_windows.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_cffi_backend.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76522\_queue.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\LICENSE.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\revealer\LICENSE_DEJAVU.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\revealer\SIL Open Font License.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_00406D50 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,1_2_00406D50
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeWindow / User API: foregroundWindowGot 493Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5DBus.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qwebp.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\sip.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtPrintSupport.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qwbmp.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qgif.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\d3dcompiler_47.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qtga.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_lzma.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtWidgets.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\python310.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\cryptography\hazmat\bindings\_rust.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtCore.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_decimal.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\select.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtGui.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_multiprocessing.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_ctypes.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qtiff.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\libzbar-0.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_hashlib.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_socket.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qsvg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_bz2.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qwebgl.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\printsupport\windowsprintersupport.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\libusb-1.0.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\pyexpat.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtNetwork.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtMultimedia.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\opengl32sw.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5QmlModels.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\python3.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qico.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qjpeg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_uuid.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qminimal.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\mediaservice\wmfengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\unicodedata.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Quick.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_overlapped.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\bearer\qgenericbearer.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5WebSockets.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_asyncio.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qoffscreen.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qicns.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\mediaservice\qtmedia_audioengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\audio\qtaudio_wasapi.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\libeay32.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qwindows.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\libsecp256k1-2.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5PrintSupport.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_sqlite3.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Qml.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\playlistformats\qtmultimedia_m3u.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_ssl.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\ssleay32.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\iconengines\qsvgicon.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\mediaservice\dsengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\hid.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\audio\qtaudio_windows.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_cffi_backend.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76522\_queue.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_1-19743
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeAPI coverage: 8.0 %
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeAPI coverage: 0.7 %
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_00408F20 FindFirstFileExW,FindClose,1_2_00408F20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_00408F20 FindFirstFileExW,FindClose,6_2_00408F20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user~1\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\Jump to behavior
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585047863.0000000005528000.00000008.00000001.01000000.00000025.sdmpBinary or memory string: .?AVQEmulationPaintEngine@@
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695F03E8 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_695F03E8
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_004014F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,1_2_004014F0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_0040117C Sleep,Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,_amsg_exit,_initterm,GetStartupInfoW,_cexit,_initterm,exit,1_2_0040117C
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_00401170 Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,1_2_00401170
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 1_2_004011B3 Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,1_2_004011B3
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_0040117C Sleep,Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,_amsg_exit,_initterm,GetStartupInfoW,_cexit,_initterm,exit,6_2_0040117C
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_00401170 Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,6_2_00401170
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_004011B3 Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,6_2_004011B3
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_0531420F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_0531420F
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695EF85F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_695EF85F
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695F03E8 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_695F03E8
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\fsutil.exe fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695EF5C6 cpuid 6_2_695EF5C6
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\_ctypes.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\_bz2.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\_lzma.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\_socket.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\select.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\pyexpat.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\_queue.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\_ssl.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\_asyncio.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\_overlapped.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\_hashlib.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\certifi\cacert.pem VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\_decimal.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\unicodedata.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76522\_uuid.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_695F059B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,6_2_695F059B
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

    Stealing of Sensitive Information

    barindex
    Tries to steal Crypto Currency Wallets
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\ElectrumJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\ElectrumJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\configJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\blockchain_headersJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\forksJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\blockchain_headersJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\blockchain_headersJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\blockchain_headersJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\recent_serversJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\certsJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\cache\CoinGecko_EURJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\cacheJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\configJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\ElectrumJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\forksJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\forks\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\configJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\certsJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\cacheJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\configJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\configJump to behavior
    Source: C:\Windows\SysWOW64\fsutil.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\blockchain_headersJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A692A40 ?isListening@QLocalServer@@QBE_NXZ,WaitForSingleObject,6_2_6A692A40
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A684A30 ?writeDatagram@QUdpSocket@@QAE_JPBD_JABVQHostAddress@@G@Z,??0QHostAddress@@QAE@W4SpecialAddress@0@@Z,??1QHostAddress@@QAE@XZ,?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ,?bind@QAbstractSocket@@QAE_NGV?$QFlags@W4BindFlag@QAbstractSocket@@@@@Z,??0QHostAddress@@QAE@XZ,??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z,??1QHostAddress@@QAE@XZ,??1QHostAddress@@QAE@XZ,?bytesWritten@QIODevice@@QAEX_J@Z,?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z,??1QString@@QAE@XZ,??1QString@@QAE@XZ,6_2_6A684A30
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A690840 ?isListening@QLocalServer@@QBE_NXZ,6_2_6A690840
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A690850 ?listen@QLocalServer@@QAE_NABVQString@@@Z,??0QMessageLogger@@QAE@PBDH0@Z,?warning@QMessageLogger@@QBAXPBDZZ,??0QString@@QAE@VQLatin1String@@@Z,?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z,??0QChar@@QAE@UQLatin1Char@@@Z,?arg@QString@@QBE?AV1@ABV1@HVQChar@@@Z,??4QDateTime@@QAEAAV0@$$QAV0@@Z,??1QString@@QAE@XZ,??1QString@@QAE@XZ,??1QString@@QAE@XZ,?clear@QString@@QAEXXZ,?clear@QString@@QAEXXZ,??4QString@@QAEAAV0@ABV0@@Z,6_2_6A690850
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A630800 ?startsWith@QString@@QBE_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z,?property@QObject@@QBE?AVQVariant@@PBD@Z,?setProperty@QObject@@QAE_NPBDABVQVariant@@@Z,??1QVariant@@QAE@XZ,?isListening@QTcpServer@@QBE_NXZ,?listen@QTcpServer@@QAE_NABVQHostAddress@@G@Z,?serverPort@QTcpServer@@QBEGXZ,6_2_6A630800
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A6848F0 ?writeDatagram@QUdpSocket@@QAE_JABVQNetworkDatagram@@@Z,?destinationAddress@QNetworkDatagram@@QBE?AVQHostAddress@@XZ,??0QHostAddress@@QAE@W4SpecialAddress@0@@Z,??1QHostAddress@@QAE@XZ,??1QHostAddress@@QAE@XZ,?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ,?bind@QAbstractSocket@@QAE_NGV?$QFlags@W4BindFlag@QAbstractSocket@@@@@Z,?data@QString@@QBEPBVQChar@@XZ,?bytesWritten@QIODevice@@QAEX_J@Z,??1QString@@QAE@XZ,6_2_6A6848F0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A690970 ?listen@QLocalServer@@QAE_NH@Z,??0QMessageLogger@@QAE@PBDH0@Z,?warning@QMessageLogger@@QBAXPBDZZ,?clear@QString@@QAEXXZ,?clear@QString@@QAEXXZ,6_2_6A690970
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 6_2_6A686C50 ??0QHostAddress@@QAE@XZ,?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ,??4QHostAddress@@QAEAAV0@W4SpecialAddress@0@@Z,??4QHostAddress@@QAEAAV0@ABV0@@Z,?error@QDnsLookup@@QBE?AW4Error@1@XZ,?error@QDnsLookup@@QBE?AW4Error@1@XZ,?bind@QAbstractSocket@@QAE_NABVQHostAddress@@GV?$QFlags@W4BindFlag@QAbstractSocket@@@@@Z,?errorString@QIODevice@@QBE?AVQString@@XZ,?error@QAbstractSocket@@QBE?AW4SocketError@1@XZ,?localAddress@QAbstractSocket@@QBE?AVQHostAddress@@XZ,??1QHostAddress@@QAE@XZ,?localPort@QAbstractSocket@@QBEGXZ,??4QHostAddress@@QAEAAV0@ABV0@@Z,?start@QElapsedTimer@@QAEXXZ,?port@QNetworkProxy@@QBEGXZ,?hostName@QNetworkProxy@@QBE?AVQString@@XZ,??1QString@@QAE@XZ,?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ,??1QHostAddress@@QAE@XZ,??4QHostAddress@@QAEAAV0@ABV0@@Z,??0QHostAddress@@QAE@XZ,??1QHostAddress@@QAE@XZ,??1QHostAddress@@QAE@XZ,??0QString@@QAE@VQLatin1String@@@Z,??1QString@@QAE@XZ,??1QHostAddress@@QAE@XZ,6_2_6A686C50

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
    Native API    		1
    DLL Side-Loading    		11
    Process Injection    		1
    Masquerading    		OS Credential Dumping1
    System Time Discovery    		Remote Services1
    Archive Collected Data    		2
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
    DLL Side-Loading    		11
    Process Injection    		LSASS Memory11
    Security Software Discovery    		Remote Desktop Protocol1
    Data from Local System    		1
    Ingress Tool Transfer    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
    Deobfuscate/Decode Files or Information    		Security Account Manager1
    Application Window Discovery    		SMB/Windows Admin SharesData from Network Shared Drive1
    Non-Application Layer Protocol    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
    Obfuscated Files or Information    		NTDS2
    File and Directory Discovery    		Distributed Component Object ModelInput Capture1
    Application Layer Protocol    		Traffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
    Install Root Certificate    		LSA Secrets23
    System Information Discovery    		SSHKeylogging1
    Proxy    		Scheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
    Software Packing    		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
    DLL Side-Loading    		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1505139 Sample: SecuriteInfo.com.Win32.Patc... Startdate: 05/09/2024 Architecture: WINDOWS Score: 45 45 15.164.165.52.in-addr.arpa 2->45 49 Yara detected Generic Python Ransomware 2->49 9 SecuriteInfo.com.Win32.Patched.24562.10289.exe 1001 2->9         started        signatures3 process4 file5 33 C:\Users\user\AppData\...\unicodedata.pyd, PE32 9->33 dropped 35 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 9->35 dropped 37 C:\Users\user\AppData\Local\...\select.pyd, PE32 9->37 dropped 39 163 other files (none is malicious) 9->39 dropped 53 Found pyInstaller with non standard icon 9->53 13 SecuriteInfo.com.Win32.Patched.24562.10289.exe 7 9->13         started        signatures6 process7 dnsIp8 47 127.0.0.1 unknown unknown 13->47 41 C:\Users\user\AppData\Roaming\...\config, JSON 13->41 dropped 43 C:\Users\user\AppData\...\blockchain_headers, data 13->43 dropped 55 Found Tor onion address 13->55 57 Tries to steal Crypto Currency Wallets 13->57 18 cmd.exe 1 13->18         started        20 cmd.exe 1 13->20         started        22 cmd.exe 13->22         started        file9 signatures10 process11 process12 24 fsutil.exe 1 18->24         started        27 conhost.exe 18->27         started        29 conhost.exe 20->29         started        31 conhost.exe 22->31         started        signatures13 51 Tries to steal Crypto Currency Wallets 24->51

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    SecuriteInfo.com.Win32.Patched.24562.10289.exe3%ReversingLabs

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\MSVCP140.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\MSVCP140_1.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Core.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5DBus.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Gui.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Multimedia.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Network.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5PrintSupport.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Qml.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5QmlModels.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Quick.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Svg.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5WebSockets.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Widgets.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\d3dcompiler_47.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\libEGL.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\libGLESv2.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\libeay32.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\opengl32sw.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\ssleay32.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\audio\qtaudio_wasapi.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\audio\qtaudio_windows.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\bearer\qgenericbearer.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qgif.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qicns.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qico.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qjpeg.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qsvg.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qtga.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qtiff.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qwbmp.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qwebp.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\mediaservice\dsengine.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\mediaservice\qtmedia_audioengine.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\mediaservice\wmfengine.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qminimal.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qoffscreen.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qwebgl.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qwindows.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\playlistformats\qtmultimedia_m3u.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\printsupport\windowsprintersupport.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtCore.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtGui.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtMultimedia.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtNetwork.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtPrintSupport.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtWidgets.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\sip.cp310-win32.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\VCRUNTIME140.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_asyncio.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_bz2.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_cffi_backend.cp310-win32.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_ctypes.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_decimal.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_hashlib.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_lzma.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_multiprocessing.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_overlapped.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_queue.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_socket.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_sqlite3.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_ssl.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\_uuid.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\backup_commands_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\bitbox02_system_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\btc_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\common_pb2.pyi0%ReversingLabs

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://httpbin.org/get0%URL Reputationsafe
    http://jqueryui.com0%Avira URL Cloudsafe
    https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION0%Avira URL Cloudsafe
    https://github.com/romis2012/aiohttp-socks/issues/270%Avira URL Cloudsafe
    https://cloud.google.com/appengine/docs/standard/runtimes0%Avira URL Cloudsafe
    https://github.com/aio-libs/aiohttp/discussions/60440%Avira URL Cloudsafe
    http://github.com/romanz/amodem/;0%Avira URL Cloudsafe
    http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=0%Avira URL Cloudsafe
    http://bugs.python.org/issue12305400%Avira URL Cloudsafe
    https://testnet.smartbit.com.au/0%Avira URL Cloudsafe
    http://python.org0%Avira URL Cloudsafe
    http://www.openssl.org/V0%URL Reputationsafe
    https://httpbin.org/post0%URL Reputationsafe
    https://github.com/bitcoin/bitcoin/blob/master/src/script/descriptor.cpp0%Avira URL Cloudsafe
    https://github.com/stefankoegl/python-json-patchng0%Avira URL Cloudsafe
    https://tools.ietf.org/html/rfc2388#section-4.40%Avira URL Cloudsafe
    http://python.org:800%Avira URL Cloudsafe
    https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#0%Avira URL Cloudsafe
    https://github.com/pypa/packaging0%Avira URL Cloudsafe
    https://github.com/satoshilabs/slips/blob/master/slip-0039.md.0%Avira URL Cloudsafe
    https://refspecs.linuxfoundation.org/elf/gabi40%Avira URL Cloudsafe
    http://bugreports.qt.io/0%Avira URL Cloudsafe
    http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bol0%Avira URL Cloudsafe
    http://www.fontbureau.comhttp://www.fontbureau.com/designersNormalNormaaliNormalNorm0%Avira URL Cloudsafe
    https://github.com/romis2012/python-socks0%Avira URL Cloudsafe
    http://docs.python.org/3/library/subprocess#subprocess.Popen.kill0%Avira URL Cloudsafe
    https://github.com/python-attrs/attrs/issues/1360%Avira URL Cloudsafe
    http://www.jiyu-kobo.co.jp/Microsoft0%Avira URL Cloudsafe
    https://github.com/spesmilo/electrum0%Avira URL Cloudsafe
    http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode0%Avira URL Cloudsafe
    https://zopeinterface.readthedocs.io/en/latest/0%Avira URL Cloudsafe
    https://www.digicert.jj0%Avira URL Cloudsafe
    https://oxt.me/0%Avira URL Cloudsafe
    https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L6880%Avira URL Cloudsafe
    http://httpbin.org/0%Avira URL Cloudsafe
    https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access0%Avira URL Cloudsafe
    http://docs.electrum.org/r0%Avira URL Cloudsafe
    https://docs.python.org/3/library/pprint.html0%Avira URL Cloudsafe
    https://api.trustedcoin.com/2/0%Avira URL Cloudsafe
    https://mempool.space/testnet/0%Avira URL Cloudsafe
    https://btc.com/0%Avira URL Cloudsafe
    https://electrum.org/version0%Avira URL Cloudsafe
    https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader0%Avira URL Cloudsafe
    https://httpbin.org/0%Avira URL Cloudsafe
    http://www.cl.cam.ac.uk/~mgk25/iso-time.html0%Avira URL Cloudsafe
    http://www.color.org)0%Avira URL Cloudsafe
    https://github.com/keis/base580%Avira URL Cloudsafe
    http://stackoverflow.com/questions/5176691/argparse-how-to-specify-a-default-subcommandFr0%Avira URL Cloudsafe
    http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l5350%Avira URL Cloudsafe
    https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy0%Avira URL Cloudsafe
    https://docs.python.org/3/library/re.html0%Avira URL Cloudsafe
    http://github.com/ActiveState/appdirs0%Avira URL Cloudsafe
    https://live.blockcypher.com/btc/0%Avira URL Cloudsafe
    https://mempool.emzy.de/0%Avira URL Cloudsafe
    https://wiki.debian.org/XDGBaseDirectorySpecification#state0%Avira URL Cloudsafe
    http://wwwsearch.sf.net/):0%Avira URL Cloudsafe
    http://tools.ietf.org/html/rfc6125#section-6.4.30%Avira URL Cloudsafe
    https://btc.bitaps.com/r0%Avira URL Cloudsafe
    https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-config0%Avira URL Cloudsafe
    http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault0%Avira URL Cloudsafe
    https://cffi.readthedocs.io/en/latest/using.html#callbacks0%Avira URL Cloudsafe
    https://bugs.python.org/issue371790%Avira URL Cloudsafe
    https://blockchain.com/btc/0%Avira URL Cloudsafe
    https://blockchair.com/bitcoin/0%Avira URL Cloudsafe
    https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py0%Avira URL Cloudsafe
    https://github.com/jaraco/jaraco.functools/issues/50%Avira URL Cloudsafe
    http://github.com/romanz/amodem/0%Avira URL Cloudsafe
    https://mempool.space/0%Avira URL Cloudsafe
    http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm0%Avira URL Cloudsafe
    http://dejavu.sourceforge.net/wiki/index.php/License0%Avira URL Cloudsafe
    https://github.com/pyca/cryptography/issues0%Avira URL Cloudsafe
    https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.0%Avira URL Cloudsafe
    https://www.attrs.org/0%Avira URL Cloudsafe
    http://google.com/0%Avira URL Cloudsafe
    https://mahler:8092/site-updates.py0%Avira URL Cloudsafe
    https://blockstream.info/0%Avira URL Cloudsafe
    https://chainflyer.bitflyer.jp/0%Avira URL Cloudsafe
    https://insight.bitpay.com/0%Avira URL Cloudsafe
    https://mempool.space/signet/0%Avira URL Cloudsafe
    https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-configG0%Avira URL Cloudsafe
    http://.../back.jpeg0%Avira URL Cloudsafe
    https://www.python.org/download/releases/2.3/mro/.0%Avira URL Cloudsafe
    https://github.com0%Avira URL Cloudsafe
    https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy0%Avira URL Cloudsafe
    https://docs.python.org/3/library/asyncio-eventloop.html0%Avira URL Cloudsafe
    http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fw0%Avira URL Cloudsafe
    https://www.digicert.j0%Avira URL Cloudsafe
    https://github.com/Ousret/charset_normalizer0%Avira URL Cloudsafe
    https://electrum.org/0%Avira URL Cloudsafe
    http://python.org/0%Avira URL Cloudsafe
    https://github.com/urllib3/urllib3/issues/4970%Avira URL Cloudsafe
    https://docs.python.org/3/library/re.html#re.sub0%Avira URL Cloudsafe
    https://github.com/ColinDuquesnoy/QDarkStyleSheet/issues/2000%Avira URL Cloudsafe
    http://yahoo.com/0%Avira URL Cloudsafe
    https://electrum.org/versionr0%Avira URL Cloudsafe
    https://blockstream.info/testnet/0%Avira URL Cloudsafe
    https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.10%Avira URL Cloudsafe
    https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular0%Avira URL Cloudsafe
    http://unicode.org/reports/tr46/).0%Avira URL Cloudsafe
    http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-60%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    15.164.165.52.in-addr.arpa
    		unknown
    		unknownfalse
      		unknown

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://github.com/romanz/amodem/;SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583962274.0000000004600000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSIONSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581898769.00000000037E0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://cloud.google.com/appengine/docs/standard/runtimesSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581827621.0000000003750000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://bugs.python.org/issue1230540SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581400054.00000000034B0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://testnet.smartbit.com.au/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581646325.0000000003600000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://jqueryui.comSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1458408323.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1459591765.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1460708940.00000000024E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1462243863.00000000024E6000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/aio-libs/aiohttp/discussions/6044SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/romis2012/aiohttp-socks/issues/27SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581827621.0000000003750000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581573254.0000000003580000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1459591765.00000000024E6000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://python.orgSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581716829.0000000003690000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://python.org:80SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581716829.0000000003690000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1493848215.0000000000827000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1493284127.00000000001FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492241928.0000000000803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1499177635.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491385442.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498239523.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490197089.0000000002456000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490308483.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491802301.0000000000803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490894645.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491504814.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1497647994.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492512320.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498042646.000000000081E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1494521580.000000000082E000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/stefankoegl/python-json-patchngSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583225136.00000000040D0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://bugreports.qt.io/SecuriteInfo.com.Win32.Patched.24562.10289.exefalse
      • Avira URL Cloud: safe
      		unknown
      https://tools.ietf.org/html/rfc2388#section-4.4SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003163000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003163000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/pypa/packagingSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580714723.00000000031B0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/satoshilabs/slips/blob/master/slip-0039.md.SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583853520.0000000004540000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/bitcoin/bitcoin/blob/master/src/script/descriptor.cppSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583112619.0000000004010000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://refspecs.linuxfoundation.org/elf/gabi4SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580653016.0000000003170000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bolSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1458408323.00000000024E6000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://docs.python.org/3/library/subprocess#subprocess.Popen.killSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580764662.0000000003200000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.fontbureau.comhttp://www.fontbureau.com/designersNormalNormaaliNormalNormSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.0000000003A18000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.jiyu-kobo.co.jp/MicrosoftSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://www.digicert.jjSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1336782875.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/python-attrs/attrs/issues/136SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000003132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524269615.0000000003135000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003145000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://oxt.me/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://docs.python.org/3/library/subprocess#subprocess.Popen.returncodeSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581260816.0000000003400000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/spesmilo/electrumSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583039420.0000000003F80000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/romis2012/python-socksSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581863026.00000000037A0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://zopeinterface.readthedocs.io/en/latest/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591376227.0000000003051000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591899706.0000000003051000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.000000000305D000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://docs.python.org/3/library/pprint.htmlSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2579405117.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490197089.0000000002456000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://httpbin.org/getSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://httpbin.org/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://docs.electrum.org/rSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591510660.0000000003A78000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-accessSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1497759033.0000000002C94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1497458279.0000000002C7D000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://api.trustedcoin.com/2/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585521218.0000000005A20000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://electrum.org/versionSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585484853.00000000059E0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://btc.com/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1493848215.0000000000827000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1493284127.00000000001FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492241928.0000000000803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1499177635.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491385442.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498239523.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490197089.0000000002456000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490308483.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491802301.0000000000803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490894645.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491504814.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1497647994.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492512320.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498042646.000000000081E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1494521580.000000000082E000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://mempool.space/testnet/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://httpbin.org/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.cl.cam.ac.uk/~mgk25/iso-time.htmlSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498473286.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498473286.0000000002C6F000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/keis/base58SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583039420.0000000003F80000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://stackoverflow.com/questions/5176691/argparse-how-to-specify-a-default-subcommandFrSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000039BB000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.color.org)SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2584872500.0000000005317000.00000002.00000001.01000000.00000025.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sySecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1493848215.0000000000827000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1493284127.00000000001FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492241928.0000000000803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1499177635.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491385442.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498239523.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490197089.0000000002456000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490308483.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491802301.0000000000803000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1490894645.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491504814.000000000082D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1497647994.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492512320.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498042646.000000000081E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1494521580.000000000082E000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://docs.python.org/3/library/re.htmlSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1517242856.0000000002FD3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1521036439.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523647364.0000000002FC2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524685226.000000000305D000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://github.com/ActiveState/appdirsSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1508291858.0000000002D2E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580653016.0000000003170000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://live.blockcypher.com/btc/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581646325.0000000003600000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://mempool.emzy.de/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://wiki.debian.org/XDGBaseDirectorySpecification#stateSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1508291858.0000000002D2E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523574953.000000000087F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://wwwsearch.sf.net/):SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://tools.ietf.org/html/rfc6125#section-6.4.3SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2579837855.0000000002E60000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-configSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583740593.0000000004480000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://btc.bitaps.com/rSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://cffi.readthedocs.io/en/latest/using.html#callbacksSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2597512220.000000006C39A000.00000002.00000001.01000000.0000001A.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefaultSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1462243863.00000000024E6000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://bugs.python.org/issue37179SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://blockchain.com/btc/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://blockchair.com/bitcoin/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://mempool.space/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/jaraco/jaraco.functools/issues/5SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2579888959.0000000002EA0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pySecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1494521580.000000000082E000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://github.com/romanz/amodem/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583962274.0000000004600000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2584035611.00000000046A0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.phys.uu.nl/~vgent/calendar/isocalendar.htmSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498473286.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1498473286.0000000002C6F000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://dejavu.sourceforge.net/wiki/index.php/LicenseSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1462886230.00000000024E6000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/pyca/cryptography/issuesSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583076129.0000000003FC0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000003132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003145000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://www.attrs.org/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581791806.0000000003710000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://google.com/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578332810.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1528642852.000000000392A000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://chainflyer.bitflyer.jp/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://mahler:8092/site-updates.pySecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1528335797.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1492947254.0000000000800000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524341335.00000000030E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.00000000030F7000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://blockstream.info/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://mempool.space/signet/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://insight.bitpay.com/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581681370.0000000003640000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://.../back.jpegSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582930312.0000000003EC0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.openssl.org/VSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1353714154.00000000024E6000.00000004.00000020.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-configGSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2583740593.0000000004480000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://www.python.org/download/releases/2.3/mro/.SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2578984098.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1491719086.0000000000841000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.comSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581827621.0000000003750000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581754093.00000000036D0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxySecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582757109.0000000003D30000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://docs.python.org/3/library/asyncio-eventloop.htmlSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1528335797.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581863026.00000000037A0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1460708940.00000000024E6000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://httpbin.org/postSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003163000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003163000.00000004.00000020.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://python.org/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000003132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003145000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://www.digicert.jSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000001.00000003.1336782875.0000000000EBA000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/Ousret/charset_normalizerSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://electrum.org/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000039BB000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/urllib3/urllib3/issues/497SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582757109.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1528642852.000000000392A000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://docs.python.org/3/library/re.html#re.subSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2579950912.0000000002EE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1517734718.0000000003022000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1517242856.0000000002FD3000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/ColinDuquesnoy/QDarkStyleSheet/issues/200SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585484853.00000000059E0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582930312.0000000003EC0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://blockstream.info/testnet/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2581646325.0000000003600000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523906255.00000000030DE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://unicode.org/reports/tr46/).SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2580091208.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000003132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590734268.0000000003122000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1532252642.0000000003122000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://yahoo.com/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2582049925.00000000038F0000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regularSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1517734718.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523647364.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591376227.0000000003051000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1517734718.0000000003022000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1521292676.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591899706.0000000003051000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1517242856.0000000002FD3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1521036439.000000000305D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1523647364.0000000002FC2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524685226.000000000305D000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1524643453.00000000030C9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591376227.0000000003051000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591899706.0000000003051000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1591612678.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1590862643.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000003.1530042500.000000000305D000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://electrum.org/versionrSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000006.00000002.2585484853.00000000059E0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious

      Private

      IP
      127.0.0.1

      General Information

      Joe Sandbox version:40.0.0 Tourmaline
      Analysis ID:1505139
      Start date and time:2024-09-05 20:27:12 +02:00
      Joe Sandbox product:CloudBasic
      Overall analysis duration:0h 9m 14s
      Hypervisor based Inspection enabled:false
      Report type:full
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
      Number of analysed new started processes analysed:19
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Sample name:SecuriteInfo.com.Win32.Patched.24562.10289.exe
      Detection:MAL
      Classification:mal45.rans.spyw.evad.winEXE@14/874@1/1
      EGA Information:
      • Successful, ratio: 100%
      HCA Information:
      • Successful, ratio: 77%
      • Number of executed functions: 45
      • Number of non-executed functions: 371
      Cookbook Comments:
      • Found application associated with file extension: .exe

      Warnings

      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe, UsoClient.exe
      • Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, slscr.update.microsoft.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
      • Not all processes where analyzed, report is missing behavior information
      • Report size exceeded maximum capacity and may have missing behavior information.
      • Report size exceeded maximum capacity and may have missing disassembly code.
      • Report size getting too big, too many NtCreateFile calls found.
      • Report size getting too big, too many NtOpenFile calls found.
      • Report size getting too big, too many NtProtectVirtualMemory calls found.
      • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
      • VT rate limit hit for: SecuriteInfo.com.Win32.Patched.24562.10289.exe

      Simulations

      Behavior and APIs

      TimeTypeDescription
      15:42:38API Interceptor26x Sleep call for process: SecuriteInfo.com.Win32.Patched.24562.10289.exe modified

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\MSVCP140.dllfr#U0435#U0435#U041a#U041cS#U0410ut#U043e#U279cN#U0435t#U279cP#U043ert#U0430bl#U0435##U28e4.zip.7zGet hashmaliciousUnknownBrowse
        SecuriteInfo.com.Win32.Patched.29806.7109.exeGet hashmaliciousUnknownBrowse
          electrum-4.5.3-setup.exeGet hashmaliciousUnknownBrowse
            electrum-4.5.3.exeGet hashmaliciousUnknownBrowse
              BEwkwcQFOA.exeGet hashmaliciousUnknownBrowse
                https://files.jalinga.com/builds/releases/jalinga_studio.4.0.2040.0.exeGet hashmaliciousUnknownBrowse
                  MedMooc.exeGet hashmaliciousUnknownBrowse
                    FileZilla_3.52.2_win64_sponsored-setup.exeGet hashmaliciousUnknownBrowse
                      f_026dfd.exeGet hashmaliciousUnknownBrowse
                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\MSVCP140_1.dllBrowser.exeGet hashmaliciousUnknownBrowse
                          SecuriteInfo.com.Win32.Patched.29806.7109.exeGet hashmaliciousUnknownBrowse
                            electrum-4.5.3-setup.exeGet hashmaliciousUnknownBrowse
                              electrum-4.5.3.exeGet hashmaliciousUnknownBrowse
                                BEwkwcQFOA.exeGet hashmaliciousUnknownBrowse
                                  https://files.jalinga.com/builds/releases/jalinga_studio.4.0.2040.0.exeGet hashmaliciousUnknownBrowse
                                    CABPRansom.exeGet hashmaliciousUnknownBrowse
                                      MedMooc.exeGet hashmaliciousUnknownBrowse

                                        Created / dropped Files

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\MSVCP140.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):454128
                                        Entropy (8bit):6.669498628019609
                                        Encrypted:false
                                        SSDEEP:12288:y9vcHNFaPZ2Jj/gMvpbUUtQgTCZuGre6gIo1hUgiW6QR7t5s03Ooc8dHkC2esrVx:ytcHNa2Jj/g4bUUtQgTn6g003Ooc8dHE
                                        MD5:ECEFF9C92E14B580EA84365F3D60F7DE
                                        SHA1:00699126456379FA48CB122E21B7F4731A72C57C
                                        SHA-256:265591A709A5DB413D73C95B538DA321EDEACB40059BDCEB142F997A3D458B49
                                        SHA-512:FD325D77EB2C30E1CD1B2D871986E057318C1BE911793521C7BF79FB2C5DC359CB7DB90C6D6C5711FEDD734B6B03117B8BAF241DFBD78585CF55A25983EC8727
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Joe Sandbox View:
                                        • Filename: fr#U0435#U0435#U041a#U041cS#U0410ut#U043e#U279cN#U0435t#U279cP#U043ert#U0430bl#U0435##U28e4.zip.7z, Detection: malicious, Browse
                                        • Filename: SecuriteInfo.com.Win32.Patched.29806.7109.exe, Detection: malicious, Browse
                                        • Filename: electrum-4.5.3-setup.exe, Detection: malicious, Browse
                                        • Filename: electrum-4.5.3.exe, Detection: malicious, Browse
                                        • Filename: BEwkwcQFOA.exe, Detection: malicious, Browse
                                        • Filename: , Detection: malicious, Browse
                                        • Filename: MedMooc.exe, Detection: malicious, Browse
                                        • Filename: FileZilla_3.52.2_win64_sponsored-setup.exe, Detection: malicious, Browse
                                        • Filename: f_026dfd.exe, Detection: malicious, Browse
                                        Reputation:moderate, very likely benign file
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mw`...3...3...3C..3...3.t.3...3...36..3<c.2...3<c.2...3<c.2...3<c.2g..3<c.2...3<c.3...3<c.2...3Rich...3........PE..L.....t^.........."!.....:...................P......................................_Y....@A.........................z...................................A.......;...z..8...........................Xy..@....................v..@....................text....9.......:.................. ..`.data...t(...P.......>..............@....idata...............V..............@..@.didat..4............j..............@....rsrc................l..............@..@.reloc...;.......<...p..............@..B................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\MSVCP140_1.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):29168
                                        Entropy (8bit):6.891197126129158
                                        Encrypted:false
                                        SSDEEP:384:ipMyA7o+HvwTgljud5u+NWc95gWWzc+pBj0HRN7LxlT3cyHRN7/Ujp9fl980:IU0AJsd5uceWncFv
                                        MD5:7F71F19F30BE3942EE0EFDDC145D459E
                                        SHA1:863048CF8A9692BF43317326C5AA918389546282
                                        SHA-256:B8CAFC52B903ED0824882365B0A0D438460260B4DDF2487849EB3BD2241F7E8D
                                        SHA-512:4FDFBC7524445EB443E189F64D9732C5C28ACE689C9556B67C8F3647BA7F18B02521DEEAE4FB8138F5F550EE34EFDB2AB2B6FFEA3A43D184A26BDFCE700B2DD5
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Joe Sandbox View:
                                        • Filename: Browser.exe, Detection: malicious, Browse
                                        • Filename: SecuriteInfo.com.Win32.Patched.29806.7109.exe, Detection: malicious, Browse
                                        • Filename: electrum-4.5.3-setup.exe, Detection: malicious, Browse
                                        • Filename: electrum-4.5.3.exe, Detection: malicious, Browse
                                        • Filename: BEwkwcQFOA.exe, Detection: malicious, Browse
                                        • Filename: , Detection: malicious, Browse
                                        • Filename: CABPRansom.exe, Detection: malicious, Browse
                                        • Filename: MedMooc.exe, Detection: malicious, Browse
                                        Reputation:moderate, very likely benign file
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................'G......~....X......X............X......X......X......X......X......Rich....................PE..L.....t^.........."!.........................0...............................p......W.....@A.........................*..J....@..x....P...............0...A...`......h...8...............................@............@...............................text............................... ..`.data...H....0....... ..............@....idata.......@......."..............@..@.rsrc........P.......(..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Core.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):5381616
                                        Entropy (8bit):6.852156967958758
                                        Encrypted:false
                                        SSDEEP:49152:q1AH+7g4QrRpvOK8Bbl+Gy+/LZsxRFNHlZTlJsv6tWKFdu9C/cPk4VHEYI9CV4eO:E5gje5lCjzJsv6tWKFdu9CtvDhgwcY
                                        MD5:7D180286E9C071C7BC3A6BC2ACE792AC
                                        SHA1:F5947D69AEAACC8A378721F3750B049CC41DDDEF
                                        SHA-256:4F8DC460162407CFCCB1BE6EF9CCE45C4449DE838AEFFA3FD33378F01A3F9CC4
                                        SHA-512:9B30D5DD48E736DA770E71622B79DA294829621565CFC4D995CA31C8CFBBBE2D577677F4240E0FF2D995DEEEB5F894018412596C141E8360DD77BF12596CE167
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........S.G.2k..2k..2k..J...2k.p]j..2k.%....2k.p]n..2k.p]o..2k.p]h..2k..Yo..2k..Ym..2k..Yj..2k..2j..3k.=Bo..2k.=Bn.D2k.=Bk..2k.=B...2k..2...2k.=Bi..2k.Rich.2k.........................PE..L...&._...........!......(...).....>x&.......(....g.........................pR.......R...@.........................P D.P....=K.......P...............R.......P..|.. .A.T...................0.A.....x.A.@.............(..............................text...W.(.......(................. ..`.rdata..n."...(..."...(.............@..@.data........`K..J...FK.............@....qtmimed......K.......K.............@..P.rsrc.........P......~P.............@..@.reloc...|....P..~....P.............@..B................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5DBus.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):345072
                                        Entropy (8bit):6.69347328565263
                                        Encrypted:false
                                        SSDEEP:6144:p7/XsDKD1OjnMFTZNgWoVEC8FMVU+SBF5h10xwSfdGX+Asf5YVJ:p7/XsDKROjQN5oVEvcU+SBvh1C5UJ
                                        MD5:431E75DD83B3B2FF1954300CC7F43060
                                        SHA1:44857528CEEA89420FFCCA97558A655B0B10849C
                                        SHA-256:B9BCA43F52D5BFBF014D1C2643516B54EEBB5B07D1DFCA8F4C266628EF9D121A
                                        SHA-512:D299B08393C5DD2064CF53CA52F2754EF16D075BF3C549A3EE212908F7537287C0ABE464EA54528B370B554993981DC2BA7C47CA300D6AA8CEB21BC847069B84
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................V.............3......3......3.......3.......~...........+...~......~.......~.:.......R.....~.......Rich............................PE..L...H._...........!................%........................................`......f2....@..........................$..0l...........................(...........H..D...T...................P...........@...............P............................text............................... ..`.rdata..H>.......@..................@..@.data...$...........................@....rsrc...............................@..@.reloc...H.......J..................@..B................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Gui.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):5894128
                                        Entropy (8bit):6.78187184482046
                                        Encrypted:false
                                        SSDEEP:49152:FKUDGaBVW3sDAPNaiCZPcSnt8KQ6oOtA/tiG7WwjrAxLXwQ98vd+hc0WM66fL5cQ:wUKssPdOy/tZWnXThVc5tnB6NDrd
                                        MD5:5B0F3D5B1B29B5E650375093C7AFA243
                                        SHA1:1920CBC98BD46A3A72BCFB45CAEFCFA2649A92E6
                                        SHA-256:80016776EFEA2B2A838C3FFA4C82E5F146BAFF68C36073C0C34668809D1C4297
                                        SHA-512:9DB9A90AB5A1A768E079CF9B10F1DA868AC7DAE774E90E139EE047C9C8FB43CC5B3E01AE3724EA74EFD64409EEEAFBCDA4F04DA3E86265575A3831A4FC69CC8C
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......hd.d,.q7,.q7,.q7%}.7:.q7.ju6&.q7.jr6 .q7.jt65.q7.jp6(.q7.up6..q78nt6-.q78np6!.q7,.p7G.q7.uu6<.q7.ut6E.q7.uq6-.q7.u.7-.q7,..7-.q7.us6-.q7Rich,.q7........................PE..L....._...........!.....V6...#......L6......p6..............................pZ.....;.Z...@..........................%=.0"...GV.h....0X...............Y......@X.l!....<.T.....................<.......<.@............p6.|............................text...zT6......V6................. ..`.rdata.... ..p6... ..Z6.............@..@.data...,....@W...... W.............@....rsrc........0X.......W.............@..@.reloc..l!...@X.."....W.............@..B................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Multimedia.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):593392
                                        Entropy (8bit):6.548929192441609
                                        Encrypted:false
                                        SSDEEP:6144:UbF/85xSKprGjwf+DC9rSBke4ki3MHun9ygXa4KPno+/+lt6h3kocBln3ShKjJm4:fcwI5kaUKvouh0FBF3SoJS72Jsy
                                        MD5:091CD90206794A3EFF2C16F8747A47D1
                                        SHA1:E23E9CEA6A8DEAE8CC143AB748EC9E84F8205FCC
                                        SHA-256:916653DE6EC324A156A49AF83D11B17B7E338E97D8DB629D5A8BE8B57E0EA639
                                        SHA-512:60ECE4153E335FB90D712CF0C5CC2D22B1324BC92FA37B2CEFFA5DED5CD76C227259BBB7B8DCBBE6B026876D13101EF7BD92422292BD08736DAE91641DC978C5
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... M.Gd,..d,..d,..mT..l,..pG..f,...C..q,...C..n,...C..b,...C..`,...\..c,..d,...-...\...,...\..e,...\s.e,..d,..e,...\..e,..Richd,..........PE..L...a.._...........!.........r...............................................0............@......................... ...d....+...................................l......T...............................@............................................text...Z........................... ..`.rdata..............................@..@.data....$...........`..............@....rsrc................~..............@..@.reloc...l.......n..................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Network.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):1051120
                                        Entropy (8bit):6.670752367944595
                                        Encrypted:false
                                        SSDEEP:24576:Aul0ktv339DOBVXaIFP698DWk7PVmr0qwjb:A8sJVWAcwnH
                                        MD5:2E3DB1CD1EC59D08706438258E86EA30
                                        SHA1:BC20B1E40049386E6BEA3F448A6852BC879A8821
                                        SHA-256:37275F3EA79D15A2792BF21F71F1DF825F201CF8B33AA1F94CA93D62D76B216C
                                        SHA-512:0C0E0E02CCADC3F2B3F6C8CBF2C162FB73734B0B244C80048968A6FE268450A270A3F92B155DAF6268FEF246D26AD417E6CEC224133FD66E6FFB3A5394B04358
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........G;.x.;.x.;.x.2...7.x./.|.:.x..|.1.x..{.>.x..}.".x..y.?.x./.y.5.x...y.8.x.;.y...x...}...x...x.:.x.....:.x.;...:.x...z.:.x.Rich;.x.................PE..L...z._...........!................Q..............d.........................0.......k....@.........................0...<e..lT..T....@.......................P.........T..............................@...............4............................text...?........................... ..`.rdata..............................@..@.data...L8.......&..................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5PrintSupport.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):267760
                                        Entropy (8bit):6.863402731081147
                                        Encrypted:false
                                        SSDEEP:6144:4Pt7KN5BjAMaTwmGyjh4C6Qiy8AoUL37fhcJ3I9VHHiy1Qfcz+IQlGXxDF4li7cn:4lE5Bj+Kyj2mF8kFOfkDe
                                        MD5:83FB40D5AB3108F18832B78574404B62
                                        SHA1:0F6AE59CA205CA75A8ECF02D0E0ED5203F894685
                                        SHA-256:74E737DDA4F666C28F9543BDE9CEE526A18D0088A780B497AD7C1772B3CADD4E
                                        SHA-512:8B9763C3AE94178A350E355F436BCC8B1802064EB2E968327AFA423688035C2AA3AE7989CB4D0F61231E1A7AEE86A2635626CCDCFCEECA3058D99520F4E38D1A
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............|..|..|.....|.O.}..|.O.y..|.O.x..|.O....|..}..|...}..|..}..|...y..|...|..|.....|.....|...~..|.Rich..|.........................PE..L....._...........!.........b......Q........................................0............@.............................o......................................d0......T..............................@............................................text...z........................... ..`.rdata..............................@..@.data...l...........................@....rsrc...............................@..@.reloc..d0.......2..................@..B................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Qml.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):2975216
                                        Entropy (8bit):6.4996884499926635
                                        Encrypted:false
                                        SSDEEP:49152:grHpbRcgtgEgnLDYZeQok3e3QiBMKbjcbKYI1YLTFXrwWGw6cTWptNrSdSG779LZ:ARcgOnLDYZeQokwuT5E7NrSdSG779LL9
                                        MD5:7CDA5037206A57CADD50B5F032876A8E
                                        SHA1:314B671B27E9602A66396EC37BDD6E70BB180D92
                                        SHA-256:E45F26EBBC2B0499E0E90F1666FD13F1BB2BED1073E828D30B6A3A70599D4BC9
                                        SHA-512:1450A79B017B4809C83C2FC4EF53DF926E3A725959B6E378C5A55C853D2151A2BA70272848962931C58596FB4174601E3DEFEDB120FD0A211D57BE9D1908EE3E
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9V..jV..jV..j_..jZ..j...k\..j...k]..j...kJ..j...kR..j...kR..jB..kS..jV..j..j...k...j...kW..j...jW..jV.{jW..j...kW..jRichV..j................PE..L......_...........!.........X............... .....f..........................-.....I.....@..........................J$..`....).......+..............J-.......+.$.....#.T.....................#......#.@............ ...............................text...j........................... ..`.rdata...`... ...b..................@..@.data...t>....*..&...n*.............@....rsrc.........+.......+.............@..@.reloc..$.....+.......+.............@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5QmlModels.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):350192
                                        Entropy (8bit):6.598734428040625
                                        Encrypted:false
                                        SSDEEP:6144:hX6wb2uBTVgttAC/trZYzAZpebGUvteg0NYMr7XPqfQ3G/7fOTvFmqi9:3BVgXt9EAUGUQg/MfXQ0m/9
                                        MD5:78E8091FEB2E6CE5646459DB0EA9E465
                                        SHA1:1731D2D47CFE21394F208F7BAFF7EA1F2E702546
                                        SHA-256:065C8D687DC74964123F4BB06319565B163B164AB09DADC1EB6929EE19755735
                                        SHA-512:B3FDF745336C7473B9AFA57432379FF32CA5105EB956779DA16DE3CD55453AF54E1420E5F514A1BD9F78107DAD4EF719089640CFD0F144D8B7A36E3E39E319D5
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+c..o..o..o..fz[.i..{i.m...m.y...m.e...m.j...m.k...r.j..o..9...r.|...r.n...r7.n..o._.n...r.n..Richo..................PE..L......_...........!.....|..................................................p......^y....@..............................[..Lm....... ...............<.......0...?..D...T...................P...........@...............X............................text...k{.......|.................. ..`.rdata..ZT.......V..................@..@.data...."....... ..................@....rsrc........ ......................@..@.reloc...?...0...@..................@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Quick.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):3489776
                                        Entropy (8bit):6.735327359739455
                                        Encrypted:false
                                        SSDEEP:24576:wLAgn4tj+U6JL9iji/2LzruK/bEdKUEAWzeauejEM5OmTi/bIi6+LPt1rt83FCbW:zT1HZEHr7OCsKbKzVZPXMC0FEUO71
                                        MD5:07266E7D049AC4499F34CE281F3A50D7
                                        SHA1:257968090B95FAE67F92F82DB9CAB1F7613D75E3
                                        SHA-256:5F246016691FF883243EE9B3C9215EB16B859B12AEFC5F4BBD2FBDA3911883DE
                                        SHA-512:D7F9CE2FB11DE178D6D38A5580C503C21FED6777067B8A8259F9FE35B44047040B705903DB4ED3FBAC821806CBD5CA1DB0F5FCBEC68CDC49282DC0E63A3257C3
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&{.&{.&{./.p.*{....,{.....!{....?{...."{...,{.2..#{.&{.p....{...'{....'{.&{t.'{...'{.Rich&{.................PE..L......_...........!...... ........... ....... ..............................`5.......5...@...........................(.._..pT/.@.....2..............$5.......2.......'.T.....................'.......'.@............. ..............................text.... ....... ................. ..`.rdata........ ....... .............@..@.data...d.....1.......1.............@....rsrc.........2......~2.............@..@.reloc........2.......2.............@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Svg.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):264176
                                        Entropy (8bit):6.70077376714061
                                        Encrypted:false
                                        SSDEEP:6144:71lj55OgW5ODJ+bXhE4o+K08LJw8Rk8bOvR1yGaucmSJyUIEDv8ma4y4GeO43iUM:7bJ+bXK4o+K08ROvR8ucmSun5h
                                        MD5:EF0D5A2DC1D7A921F2BB0EB3EEF2E481
                                        SHA1:CB167EC49221EC5245FD9BFF7E7EED6C7CF38D51
                                        SHA-256:ADE28D4CBAC1E033468CB48F380352F0DF7FBBCE03261C48827B8A5ED7A1548E
                                        SHA-512:ECB41CB9BC4A4470F039D02441A0C0E8C596FFD55DEB924E516C4C8FC880357D5D2D1EF36E63B1303FAA7DAC5C921679A0F405C39F6E0B32B3746C972653B789
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..j.o.j.o.j.o.ck..l.o..|n.h.o.~xn.h.o..|j...o..|k.`.o..|l.i.o..cn.m.o.j.n...o..cj.g.o..co.k.o..c..k.o.j...k.o..cm.k.o.Richj.o.........PE..L......_...........!.....T...........\.......p.....f......................... ............@.............................@}...<..................................8/......T..............................@............p..\............................text...{S.......T.................. ..`.rdata..NL...p...N...X..............@..@.data...............................@....rsrc...............................@..@.reloc..8/.......0..................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5WebSockets.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):122352
                                        Entropy (8bit):6.478532411200339
                                        Encrypted:false
                                        SSDEEP:3072:v2w9BY91mB0E7PH4r+/yr5Cmwk7FyM0DO2:v2wPPHwhwk7FqJ
                                        MD5:60BF6B69FB580B6F719394AA8277503C
                                        SHA1:CB37BAF5B1648B805A07E0DEA59C3A0A65345835
                                        SHA-256:B8F83F5E56622AFCC257FA6883AD2DDC24934F21619037DDC637C691ACB80F33
                                        SHA-512:64CED39966851953B5ACB6769DA72AD6AB19E2D42515B6ABD0F6F1EDC621137E0451604E5EF95C228065C54463D2AD4BA0707984AA516FEF6F8C72D04DCB94D9
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3+E.]xE.]xE.]xL..xA.]x..\yG.]xQ.\yG.]x..XyP.]x..YyO.]x..^yF.]x..\y@.]xE.\x.]x..XyV.]x..]yD.]x..xD.]xE..xD.]x.._yD.]xRichE.]x........PE..L......_...........!................&...............................................@.....@.........................`5...!..0W.......................................)..T....................*......`)..@...............4............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\Qt5Widgets.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):4459504
                                        Entropy (8bit):6.83333130328421
                                        Encrypted:false
                                        SSDEEP:49152:ypo1FNXS+dh75PMvZZNNt+iIo5uL5Sdbtye6cEu0n:oIPqZZUfwusae6ju0n
                                        MD5:DA70580648A398AB1C5336EE9EC631CA
                                        SHA1:FA67A8A2D7F7930A45974DCB7A12E56914BF0A57
                                        SHA-256:600285754E7EEE7239B9D252DBED5C9D2C9C4C432751B8953DCB2E8B45E0408A
                                        SHA-512:83D85DF1717A5B1DD5B31F5AB33E73D1442027A719AF7FDCD20D578598F436D63E7CF58287CBE34DBEE8D5B0464A68DFD471D8EC6A95A3168EB8639864A7ADFC
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........t..t..t...:.t..W...t..W...t..W...t..W...t.....t.....t......t..t..x......'t......t....V.t..t>.t......t..Rich.t..........PE..L....._...........!......*...........*.......+....e.........................0D.......D...@..........................Y6..'....>.T....`A...............C......pA.`....o5.T....................p5......o5.@.............+../...........................text...:.*.......*................. ..`.rdata..j.....+.......*.............@..@.data....w....@..r....@.............@....rsrc........`A......4A.............@..@.reloc..`....pA......:A.............@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\d3dcompiler_47.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):3466856
                                        Entropy (8bit):6.444422172074855
                                        Encrypted:false
                                        SSDEEP:49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
                                        MD5:C5B362BCE86BB0AD3149C4540201331D
                                        SHA1:91BC4989345A4E26F06C0C781A21A27D4EE9BACD
                                        SHA-256:EFBDBBCD0D954F8FDC53467DE5D89AD525E4E4A9CFFF8A15D07C6FDB350C407F
                                        SHA-512:82FA22F6509334A6A481B0731DE1898AA70D2CF3A35F81C4A91FFFE0F4C4DD727C8D6A238C778ADC7678DFCF1BC81011A9EFF2DEE912E6B14F93CA3600D62DDD
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q...0.X.0.X.0.X=.DX.0.X=.EX.0.X..DX.0.X..FX.0.X.0.X.0.X..@X.0.X..EX.0.X..AX.0.X..XX@0.X..BX.0.X..GX.0.XRich.0.X................PE..L...n..R...........!......1.........7.0.......1..............................`5.......5...@...........................1.u... .2.d.....2.@.............4.h<....2....p...............................h...@.............2. ............................text...%.1.......1................. ..`.data...<.....1..^....1.............@....idata........2.......1.............@..@.rsrc...@.....2.......1.............@..@.reloc........2.......2.............@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\libEGL.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):23024
                                        Entropy (8bit):6.3575722696909756
                                        Encrypted:false
                                        SSDEEP:384:BH0ECfljwSVn5jd2J5uIVndDGn7Dgf2hOi:BtCZn5jMruIFdDGn7Uf2hOi
                                        MD5:371AEB50F7816108B346B67EF2B11E1A
                                        SHA1:5DE780B46D7663D1615727EDABA32B5709286D38
                                        SHA-256:12903D93A7F57B479401602A533849E6F813FF5C2C92F3A02D468FC98E7AC1D5
                                        SHA-512:4AFF94ADBD97948766C7839220E15000A4DEFB7D46B5502872B16225E8C5B85B6B674B632455AFBB3DB729D5F2E9666B32B8DB282EA3499EBD84FE4CE11D9631
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u...u...u......u...t...u..t...u...p...u...q...u...v...u.E.t...u...t..u.E.p...u.E.u...u.E.....u.......u.E.w...u.Rich..u.........PE..L....._...........!.........*...............0............................................@..........................5.......>..d....`..H............>.......p.......1..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....rsrc...H....`.......6..............@..@.reloc.......p.......<..............@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\libGLESv2.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):2937328
                                        Entropy (8bit):6.526679153933017
                                        Encrypted:false
                                        SSDEEP:49152:OOs7dcfIlADvQs46Bw6OtkrSjfM0E66+k:cdcuA8s4Fte
                                        MD5:7FF6836C626BBC7F0833A66AA77A7A7F
                                        SHA1:9AD21C1A5DF940999BA9F884D21868D3B69E7155
                                        SHA-256:8CFC024D09A6784486DA7DC0EBFD90C0C8136B27C08EC1C3F352CD4FA43B9273
                                        SHA-512:8FF378B9D2A1058396FF5E9795F7BD25FC3092F94B9274447C849C19294569197F6920BDA448A3E2C06B012BA1468D75F2B26ED1BD4E54191F28CA209BF41697
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M6M.#eM.#eM.#eD..e].#e..'dG.#e.. dD.#e..&dV.#e.."dI.#eY."dJ.#eM."eO.#e.&dC.#e.#dL.#e..eL.#eM.eL.#e.!dL.#eRichM.#e................PE..L....._...........!......"..&......}. ......."...............................,.....;a-...@...........................*..\...l*......0+.P.............,......@+.t....'.T....................'..... .'.@............."..............................text....."......."................. ..`.rdata........".......".............@..@.data.........*......|*.............@....rsrc...P....0+.......+.............@..@.reloc..t....@+.......+.............@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\libeay32.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):1297408
                                        Entropy (8bit):6.797045895691215
                                        Encrypted:false
                                        SSDEEP:24576:VUT+idPQfrZSZ9is0eiJUHV3fMPmBH0K6gElgzx9KlHGMQ7PHnq51FdZoYff9:EiZSZK2jHd6lHGMQ7PHq/XZoSf9
                                        MD5:732928B0091928B1DCCA5AD7D908E58D
                                        SHA1:E2D52810BA6C665A75ACE33DC1D963123A6A50D7
                                        SHA-256:C28EB9E000A4232F918A88159FCF376FD4EBE706024DE86DE4E371433859D320
                                        SHA-512:5CFF31C15BA76375FFA1E1C908177DC4AE5BC83E8488EAA2D73D9C98BD96A758E15180C1F3DD6928A6D22259477AA6449359CB2DF9589D5201781AF07A1091A9
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8o..|..I|..I|..Iuv+Ij..I.f.H~..I.f.Hv..I.f.Hv..I.f.H{..I.j.Hw..I|..I...I|..Ii..I.g.H<..I.g.H}..I.gGI}..I.g.H}..IRich|..I........................PE..L...;..]...........!.........j............................................... ............@.........................0...........h....p..H...............................T...........................(...@...............t............................text............................... ..`.rdata...>.......@..................@..@.data...t........`..................@....rsrc...H....p.......&..............@..@.reloc...............,..............@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\opengl32sw.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):15995904
                                        Entropy (8bit):6.353584600934879
                                        Encrypted:false
                                        SSDEEP:393216:rNkEXgt/UOdyRLjqkmbBDrta60HYUnuedxO0g//NuPyEMO32ovq:rN1QtXdyRLjqNbBDrta60HYUpO0Q/NuZ
                                        MD5:8B197F55264A44B7B25046F7BA5BD7D2
                                        SHA1:CEF69E168160968E00FFFFA136E1AF7819E7C0CE
                                        SHA-256:25AE7577E066FA80519A8F1C314B15CDD22E4A8D3ECD2A36ECCC79E40714A91D
                                        SHA-512:6AF2B1B17A7E3460099359A6750221AACB8F9CE0E80B346DBAFD2CBD8E579543B980F98E0AEB199E0781A045C9D6A7F2F11C8628F960C13550328487B7FA9154
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l%..K...K...K.......K.......K.......K.;.....K..PH...K..PN...K..PO...K.......K...J...K..PO...K..PN.I.K..PC...K..PK...K..PI...K.Rich..K.........PE..L.....`W...........!..........H......D....................................................@..........................v.....t...........................................T...........................X...@............................................text............................... ..`.rdata....<.......<.................@..@.data...pp... ......................@....gfids..............................@..@.tls................................@..._RDATA..............................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\bin\ssleay32.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):281600
                                        Entropy (8bit):6.362792344200413
                                        Encrypted:false
                                        SSDEEP:6144:yqQcCHyQdCb4R7sUHmDP/Cl3QmedVi3fL3ldtQBRdrQJq7av4vX0WezQ0RYA+Ooz:jQcCHyQdCb4R7sUHmDnCl3QmedV2fL3w
                                        MD5:5856074EE91B0F315E2C436F306EDA09
                                        SHA1:42A222BC006E14E9C2DDBFE6197D201EC842B557
                                        SHA-256:F15F2E0484BF015856FAAD6AC54CB4A6E8751806C8A9644DA32BD58F9C55521B
                                        SHA-512:7D9D0C6D15887F935A0AB4034912A147CB0E47A8208009A7310874271502F691EEB86DE184A0CF3E32C6999CC6BF8A2FFC629E0015E9C2A0DCAABD39617E7151
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P4+N.UE..UE..UE..-...UE.F=D..UE.{1D..UE.F=@..UE.F=A..UE.F=F..UE..<D..UE..UD..TE..<A.&UE..<E..UE..<...UE..<G..UE.Rich.UE.........PE..L...P..]...........!.....,... .......5.......@............................................@..............................).. ........P..H....................`...%......T...............................@............@...............................text....+.......,.................. ..`.rdata.......@.......0..............@..@.data...D1..........................@....rsrc...H....P....... ..............@..@.reloc...%...`...&...&..............@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\audio\qtaudio_wasapi.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):89072
                                        Entropy (8bit):6.536218125453265
                                        Encrypted:false
                                        SSDEEP:1536:uLAHXpkWC/CkCvCFCiW124BuTU8lF9+f7BdtenWWM11oD+k0B+C4f09IPKkwYrYK:uLAHXpkk12LU8r9+jBdteBh+k0B8fZPn
                                        MD5:A3CE61417B3D6049B14BD6E07642FA41
                                        SHA1:A0A82923F6B6455BE5644E33F2B6E5365CF8D4E7
                                        SHA-256:2961E1C94FD641312B7747A9B2D07F05B420C5C68C29242283F1B7F182E427A2
                                        SHA-512:91312A776D48B801CE946A8448F73549686CEA1201C7E21DBC41E972DDBBDD2CDAEE2E255BA3B3B961E70306CFE00BEEC2664EE6AA872073896624CE4C3E757D
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.H.4.&.4.&.4.&...".>.&...%.1.&...#.,.&...'.0.&...'.0.&.=...>.&. .'.3.&.4.'...&...#.=.&...&.5.&....5.&...$.5.&.Rich4.&.........PE..L......_...........!................................................................V.....@..........................................`..P............@.......p..........T...........................8...@...............\............................text............................... ..`.rdata...T.......V..................@..@.data........0......................@....qtmetad[....P......................@..P.rsrc...P....`....... ..............@..@.reloc.......p.......$..............@..B................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\audio\qtaudio_windows.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):53744
                                        Entropy (8bit):6.514657800964626
                                        Encrypted:false
                                        SSDEEP:1536:JymY3USpNcShD+t9QS6bkZYKrChimrJvFUfw:kmY3UsVI9H6xiChim1v/
                                        MD5:88577BFC1A8F34CBF575205DB3F1CB31
                                        SHA1:CB9D72FA0DD97CD4008015551CC5764C9BE328C7
                                        SHA-256:868C105861B6FB2207997A9B13D52B8CC0A22CE37D63382A869FD33277526213
                                        SHA-512:4C3D65ADFAEE850E40F2725FCA62A11F3B6652C8ADAD2E7372222E53F77C538A1904B4A7ED6DF8167DD08D6BAC628160CAA3EB5906673D2F9A467947D85C45B8
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0../t..|t..|t..|}..|r..|..~}v..|..z}a..|..{}~..|..|}q..|.~}p..|`.~}}..|t.~|...|`.{}v..|.z}s..|..}u..|.|u..|.}}u..|Richt..|........................PE..L......_...........!.....f...P......%l....................................................@.............................|...............P.......................@...\...T...................h...........@............................................text....d.......f.................. ..`.rdata...6.......8...j..............@..@.data...............................@....qtmetadb...........................@..P.rsrc...P...........................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\bearer\qgenericbearer.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):44528
                                        Entropy (8bit):6.480493686402605
                                        Encrypted:false
                                        SSDEEP:768:EYnMoTheMJroMOENIFanla6PK2Jbga+5+yAXmjkJuDZbjV52dDGFeTUf2hl:Xhe8O6QalaYbga+PjkJuDZbn2VTUfy
                                        MD5:57F3FFCF6A99ABDECA93D0BEBD9F05D8
                                        SHA1:F1B7038C4F6CAD75B8A6D115255421D60F1DE04F
                                        SHA-256:44B59C980CA26ACA133BD3842155C55EB30630853C3C316E1955415E10B34C0F
                                        SHA-512:CBE0ED19D03540FFEF93C4028BA7BF170CA82D1BFD15D432C7FB0EDF96E450C9DDD85701B3EF52EDABAC96FD3CB6E3DA2EADF4ED1DE3907E986E8F3D64DD3B08
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Dq..*"..*"..*".."..*"m.+#..*"m./#..*"m..#..*"m.)#..*" .+#..*"..+#..*"..+"..*" ./#..*" .*#..*" .."..*" .(#..*"Rich..*"........................PE..L...H._...........!.....D...L.......J.......`......................................;.....@.........................Px..|....x..........P............................n..T....................o.......o..@............`...............................text...DC.......D.................. ..`.rdata...7...`...8...H..............@..@.data...............................@....qtmetadj...........................@..P.rsrc...P...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):58864
                                        Entropy (8bit):6.60633814610451
                                        Encrypted:false
                                        SSDEEP:1536:QNa1alH+mupJQnk4RBWaDMGRZPwa3CocG4jUfV:o3lH+QDMGRZPwq4c
                                        MD5:CF779FF4BAD071CE54550437A2730955
                                        SHA1:2EAF309EA638320BCB9A775C748E294DA57ACDED
                                        SHA-256:D132BBE8ED3EF8288B7089366F5DAF8AD732354A051BA661406BD57734C18FFA
                                        SHA-512:5C7384C0EA4271193F88B31A1DCD28A9C74065163DEEBF85D891F0832A285871E8A867794FFFC79B50AD9F4D93CCE56B2A3BDDDA86160499D5BF8EF5918AA6CC
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(kL.l.".l.".l.".er..h."..e#.n.".xa#.n."..e'..."..e&.f."..e!.n."..z#.k.".l.#..."..z'.i."..z".m."..z..m."..z .m.".Richl.".........................PE..L...A._...........!.........J......*...............................................1U....@................................P...........X...............................T...............................@............................................text....~.......................... ..`.rdata...1.......2..................@..@.data...T...........................@....qtmetadi...........................@..P.rsrc...X...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):35824
                                        Entropy (8bit):6.522245949878045
                                        Encrypted:false
                                        SSDEEP:768:crdZm5mjw1lQR8Z3Zf3V+hFem0wKk84XmydDGFUf2hE:6u1lQQ3Zf3V+Lem0wKk849kUfP
                                        MD5:A85EA17FB2CA9258E71D0A60667EAE6A
                                        SHA1:9BC4333321611769A51BCB5292C0517C227614C6
                                        SHA-256:5456152400A84C153728007BD1C7D549788D2300441ADDD40C18D7E17F757856
                                        SHA-512:EAD8A715F75C82FE85A2D475010D8C880B13700C847840810BD6F75F6A4A418DED406133404A1C3D196461D676F8819A7BFF25E556D25250D031E513303F81EB
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................................................B.........X..B......B......B.v....B......Rich...................PE..L......_...........!.....8...8.......>.......P............................................@.........................0]..x....]..........H............p...............T..T....................U......0U..@............P..x............................text....6.......8.................. ..`.rdata...%...P...&...<..............@..@.data................b..............@....qtmetadj............d..............@..P.rsrc...H............f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qgif.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):34288
                                        Entropy (8bit):6.411504035676847
                                        Encrypted:false
                                        SSDEEP:768:aL5MPkjurnzyuVlfehyScQeOYGuOU9OOHhTNAYFdDGzUf2hW:aNYnzyuLeEfQeFGuOU9OOHhZAYFOUf5
                                        MD5:E3A1338EFADABB9FC23D955AF9A7E070
                                        SHA1:DFBE82B183FFF002A2E841D73474C78F646FDBA2
                                        SHA-256:F1FA3BFEEA6A600F2C6D209775154CEE349B7F687CB4F7213A8CAD8870DBB812
                                        SHA-512:0413A6116E227FA6A3DD7DA6FA4BB8DB59ED64FC16E37BFA49CA28C687FE791941B3A23193796EB0ECE458E87F9F78F587B3A1FE0F188B63B9148037997DF1A2
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........O)..!z..!z..!z..z..!zh. {..!z.. {..!zh.${..!zh.%{..!zh."{..!z%. {..!z.. z.!z%.${..!z%.!{..!z%..z..!z%.#{..!zRich..!z........................PE..L...1._...........!.....:...0.......A.......P.......................................=....@.........................p\..t....\..........@............j..........d...$T..T...................0U......xT..@............P...............................text...t9.......:.................. ..`.rdata.......P.......>..............@..@.data........p.......\..............@....qtmetads............^..............@..P.rsrc...@............`..............@..@.reloc..d............d..............@..B................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qicns.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):38384
                                        Entropy (8bit):6.558386736803828
                                        Encrypted:false
                                        SSDEEP:768:nwFo5IoYXrOOmYaRCNOq9QNdhVJ0hBEH3lMwAJXGdtpZmPdDGGzUf2h2:wWBIf9QvJgEX6wAJXGdtpZmP3UfP
                                        MD5:862A826020DFE7AB690900A87250992D
                                        SHA1:983117858F162F7EAB3F4AEE6E0D9619E20637EF
                                        SHA-256:F96E413DC1B8A67C025B3D1769241EE96DD8B079B367A6C868D650A6B68154C4
                                        SHA-512:A71CDFBA3023934D0BFE25A05D2FDA00F60CAAF77122CC0D52C7C6F6555EBF43E13555B563A564023C02E9419471A8ED325D182508AD276517C68C9691D5704A
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pj..4...4...4...=s5.2....d..6... `..6....d..'....d..>....d..6....{..1...4........{..6....{..5....{Y.5....{..5...Rich4...................PE..L......_...........!.....:...@......jA.......P............................................@.........................@e..t....e..........@............z...............\..T....................]......@]..@............P..<............................text....9.......:.................. ..`.rdata...+...P...,...>..............@..@.data................j..............@....qtmetadx............n..............@..P.rsrc...@............p..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qico.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):32240
                                        Entropy (8bit):6.4704292078665375
                                        Encrypted:false
                                        SSDEEP:768:1wLKUeP1ob4OgufLCJGqU2SZ6HseQdDG0Uf2hKT:4KUeP1WyufLCJGqU2SZ6HseQ9Ufz
                                        MD5:7200F8E1AF1C6A60501D5FEF7772FD0B
                                        SHA1:5F2BAC81A60F7FDFBE8B1A01F111660A3614D679
                                        SHA-256:35CF0AE6BCD1B8322482D40BF2DD693E276548885284B88E6631AB18A0C2C60E
                                        SHA-512:097835D4C8C61C2489E831B31A8BB6F2FEEA277439D6697B6E3165CCB6E4758986C9A1FA754696DA53B6005A041156FF8BC455A71DC31EA799F5891348A07F22
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.O..d!..d!..d!......d!... ..d!... ..d!...$..d!...%..d!..."..d!.. ..d!..d .d!..$..d!..!..d!.....d!..#..d!.Rich.d!.........PE..L...1._...........!.........4......;4.......@............................................@.........................`M..t....M..........@............b...............D..T....................E.......D..@............@...............................text....,.......................... ..`.rdata...!...@..."...2..............@..@.data........p.......T..............@....qtmetad.............V..............@..P.rsrc...@............X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qjpeg.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):374256
                                        Entropy (8bit):5.647982656907108
                                        Encrypted:false
                                        SSDEEP:6144:QsC804cB4tEXoOitMk5R8vsLK0LXz5pmglF90l7s0aGajl8Z9cg:Qr4bOzk5R+s5LFg9cg
                                        MD5:438B696A9811CD821BBE2C54B5C1B4B1
                                        SHA1:55EB74A0015228B1E6C1DC97E6F427C9DC804587
                                        SHA-256:84C23191B5E35EAF899358C21445A5377845C0653668BBD99B1AA8796E0248C7
                                        SHA-512:961ED9CFCD61A1FC32DE89CB97100AAA9A9225C80673B2176975BF62AF7F3A0E77A91FB723ED52C553E10A6F754A5E8C8085BDFBD56EF2DE8144C53BF41F4E91
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a(a.%I..%I..%I..,1../I...&..'I..1"..'I...&..0I...&../I...&..!I..9.. I..%I...I..9...I..9..&I..9..$I..9..$I..9..$I..Rich%I..........PE..L...X._...........!.....................................................................@......................... u..t....u..........@............................l..T....................m...... m..@............................................text...$........................... ..`.rdata..(...........................@..@.data...............................@....qtmetad............................@..P.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qsvg.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):28656
                                        Entropy (8bit):6.306194975087341
                                        Encrypted:false
                                        SSDEEP:768:WV5VVvwZ12uh991MD9dhQwe+oQQUcesJbT73dDG5Uf2hg:IvwZ12aC9Qwe+ZQUbsJbTLwUfX
                                        MD5:F304A2C8067F804D25B98D360E92829F
                                        SHA1:DAE1D07DE8C33912FF4FFC957F8817B2B3E8293A
                                        SHA-256:E45893BB7DB31BFD32E87DC7A6B02709FCA36EB83A25AEDC45A39178EC80051E
                                        SHA-512:5BC122BEA8DE687820932666C6B76BB153B115263B31A40FD7823A2A36EBC88B27626E06E3A6C5DC5F62970C8C7E9C094984B494D7F279BFDB9BAC7A8C2964CA
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................................................B........D...B.....B.....B.u....B.....Rich...................PE..L......_...........!..... ...4.......%.......0............................................@..........................<..t...T=..........@............T...............4..T....................5.......4..@............0...............................text...T........ .................. ..`.rdata..h ...0..."...$..............@..@.data........`.......F..............@....qtmetad.....p.......H..............@..P.rsrc...@............J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qtga.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):27632
                                        Entropy (8bit):6.3327508725091315
                                        Encrypted:false
                                        SSDEEP:384:kg8gKOwVg6VjbFnOfEIzPMoVhWyrsdnyBSxQrrVIyndDGdEDgf2hR:kPxOQXOfEnoVh5/BSxQrxIYdDGKUf2hR
                                        MD5:367C723591FDE64C38202D4C0F5ECFDE
                                        SHA1:C13D74F417601C656F343F00D15E56517EE03B6A
                                        SHA-256:CCD620E74045D9C9157903120140B97419CBBE91FD43337E640C67CD4522072A
                                        SHA-512:31C084BA00E094E30C6F912ECD045E19C4451D8783A80DC99B99098F84C5500665A35AC901B0FDE84D04DF898AD67448E83539A7DAA4928E8C78F798B359B256
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&...b...b...b...k...d.....`...v.`.....p.....h.....a.......g...b...........a.......c.....b.c.......c...Richb...................PE..L......_...........!.........2.......$.......0............................................@.........................`?..t....?.......p..@............P..........(....5..T....................6......(6..@............0...............................text...d........................... ..`.rdata.......0... ..."..............@..@.data...L....P.......B..............@....qtmetadu....`.......D..............@..P.rsrc...@....p.......F..............@..@.reloc..(............J..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qtiff.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):353776
                                        Entropy (8bit):5.798077806376592
                                        Encrypted:false
                                        SSDEEP:6144:BpYIdJpn0zXsT6DP64icIkjEkaNCTjM+8kBHWNFnHJXGFkDQDWr:jYIp06+IkjeNGjIkZZKr
                                        MD5:49B6F0BA901F649AB110744E34076951
                                        SHA1:4C9EEBADB5B86147EA94F48EAA6705A4B75B3E61
                                        SHA-256:5128AEDF4BD9B747AC848BF85E0FFB99BA814BD8E671ADFF7D26391D31259050
                                        SHA-512:B42A13F0215A194F77781AC74CF55C24A0F0BC99CC872EA06125CFE12FFEF93ADD0665991339DB3B7962262E6D381F20227DA3272360450B53993D06BC0EC98A
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................5...F..........F.....F.....F.............&......................Y.........Rich...........PE..L......_...........!.........^............................................................@.............................t...4........P..@............J.......`......d...T...................p...........@............................................text...$........................... ..`.rdata...........0..................@..@.data........0....... ..............@....qtmetad.....@.......$..............@..P.rsrc...@....P.......&..............@..@.reloc.......`... ...*..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qwbmp.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):26608
                                        Entropy (8bit):6.424614950505374
                                        Encrypted:false
                                        SSDEEP:384:j9NLeETizwsASWjsUE2rBiQtp4VmsdXurvZJ4EndDGgDgf2hcU:xNLXiHAS+E2rBi7mbrvZJPdDGgUf2hcU
                                        MD5:7A05C8435FB60F43958120B22B653B54
                                        SHA1:79D7122E4AB89DC9978FCD48FCBF0C6B8AE3F690
                                        SHA-256:7C946F750413716A714884C8836D24AA6D2561B48E7F3397BAB88AF348E078EC
                                        SHA-512:74800A623E4789C245095B6AD0CC03EC8EB00431487E7977BD3BC5CBF0278480474D74FD194873F220DD5682EEC88864095659315F68D650C1CC8B40435B182C
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%...D.D.D.<r..D.Q+.D./.D.Q+.D.Q+.D.Q+.D..4.D.D..D..4.D..4.D..4...D..4.D.Rich.D.................PE..L......_...........!................[%.......0.......................................\....@.........................P<..t....<.......p..@............L...............3..T....................5......P4..@............0...............................text............................... ..`.rdata..^....0......."..............@..@.data........P.......@..............@....qtmetad~....`.......B..............@..P.rsrc...@....p.......D..............@..@.reloc...............H..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\imageformats\qwebp.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):412656
                                        Entropy (8bit):6.72175950156531
                                        Encrypted:false
                                        SSDEEP:12288:llTSf8S+PHunhrYzVcS/CQVy7wycv+QrUwDHHgxgG:L08S+PO1OVcS/XVykyI+4M9
                                        MD5:B9416990AF043CA8CFA668121184C05D
                                        SHA1:4181D92E91704B961A22B51713705D53DDA0CF51
                                        SHA-256:50FCF1FED7612AE4C346D7AE7DEC3EBBBD2AC31C5E954263A7BBC655502E3B03
                                        SHA-512:E303E4B166ADA78DBE75639B73EFE275A0E4F49A1CD2DA5016E1F31A1A012AEE383E6ACC21D63561E78321B1E162EC9CFEC3915909E698D2064B1FB0DD33DE76
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~............gY.....p.....t.....p.....p.....p....Yo.......K..Yo....Yo....Yo....Yo5....Yo....Rich...........................PE..L......_...........!.....`........../h.......p......................................6b....@.............................t............P..@............0.......`...#......T...............................@............p..L............................text....^.......`.................. ..`.rdata..t....p.......d..............@..@.data...L ..........................@....qtmetadv....@......................@..P.rsrc...@....P......................@..@.reloc...#...`...$..................@..B........................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\mediaservice\dsengine.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):249328
                                        Entropy (8bit):6.60433177058215
                                        Encrypted:false
                                        SSDEEP:6144:cvrmV0Yz9nN8vIy/9fFhVGpz4FX+kmABj//TNmudDorfpng++hO:cTQ0YQwy/9fFhVGpz4hGmO
                                        MD5:9B50FCC0A5B05E57E5FA79E90AE40614
                                        SHA1:1309F865492AC2307B09F5638290B9D1BDF36C03
                                        SHA-256:26E1916B58D688E28B5746B2D81C10A4A09C8FC13E78DB62BB590D8CD648FBA9
                                        SHA-512:813A9BE26BE0DAFBBC30910D89F335505596177FE31F5885B99093BC7DC6267DEF482C077A13298AC3467476A75B773BF54F0B3A8E10503F8AB9614B01CF935C
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......9a..}.f.}.f.}.f.tx..u.f..oc.n.f..ob.w.f..oe.x.f..og.y.f..pg.w.f.ikb.{.f.ikc.|.f.ikg.j.f.}.g...f..pc.?.f..pf.|.f..p..|.f..pd.|.f.Rich}.f.........................PE..L......_...........!.....V...\.......\.......p......................................E.....@.........................P...x...............H........................5..t...T...............................@............p...............................text...TU.......V.................. ..`.rdata.......p.......Z..............@..@.data....%...p..."...T..............@....qtmetad.............v..............@..P.rsrc...H............x..............@..@.reloc...5.......6...|..............@..B................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\mediaservice\qtmedia_audioengine.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):55280
                                        Entropy (8bit):6.443475230181386
                                        Encrypted:false
                                        SSDEEP:768:OKP3SZO/dRMNQfEqLL0tc1wl6yEPSFSQEii7t0JSuK5VFVd9hkTBaY4/4qm8Ci3n:uO/oNQsptc1+6WmCBa/4qmHejEUfT
                                        MD5:54F6DC69CD4C4B1C7AEF4305AA10C9C1
                                        SHA1:A90EB329D9B359DBD561F0F57BB512AD29EF333C
                                        SHA-256:E1207397F01FBA55A45224F1F451C2F0D946E3D2B7DF30BF67E81BF91FE8A114
                                        SHA-512:1CC1F6D623519E06DF5FE943B04DC0CB99EFB42CDBB5C5F91DF79FF8DC9B086419E6474E71A835FB180F9994C728C6DC0289DB724704A2ABBB1C2DC857263020
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............}..}..}.....}.V.|..}..|..}.V.x..}.V.y..}.V.~..}...|..}..|.`.}...x..}...}..}.....}......}.Rich..}.................PE..L......_...........!.....R...j.......X.......p............................................@................................. ...........X.......................4.......T................... .......h...@............p...............................text...4Q.......R.................. ..`.rdata..PL...p...N...V..............@..@.data...............................@....qtmetad............................@..P.rsrc...X...........................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\mediaservice\wmfengine.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):173552
                                        Entropy (8bit):6.564920633762343
                                        Encrypted:false
                                        SSDEEP:3072:hz8GUoKQkSqmFyCxkFZQCn3ePX1ggRkf943m6WjD/ISrN1dK1WgCOcf7Ka8G:hz8QkSqmFyCxM3q1ggRkf943m6WjD/Io
                                        MD5:6346691E82EB3A5D8BEC7F39440A0581
                                        SHA1:D53DDE9FEF595C0707BD394ECA1A4539FD3C1B72
                                        SHA-256:3EB8D4CC2E2C9DC3C3703CAAEC8EFA9982D4B9C325541FB1642777110A9FB265
                                        SHA-512:18044C918E284327E7CD7B3F94E51022E811B028810CC3457690E02A68B7307EAA8D96179863B64EC357D2651B718AF6660548BF488EED605D169BE90C4407BD
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$..........H....................x.......x.......x.......x...............5..........................................S...5......5......5.m.....5......Rich............................PE..L...z.._...........!.................................................................N....@.........................`...x...............H........................#..|...T...............................@............................................text............................... ..`.rdata..Z...........................@..@.data........`.......F..............@....qtmetad.............`..............@..P.rsrc...H............b..............@..@.reloc...#.......$...f..............@..B................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qminimal.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):701936
                                        Entropy (8bit):6.797990435428196
                                        Encrypted:false
                                        SSDEEP:12288:49mqUd6YYwP+SbYFBsBHd5TsB0d3zV21lnjbduklgo123zDfEWmd9:49m4Y1+OYABHDsB0x41lnXIeZP
                                        MD5:2AFD07C16A47B2CDE639D777CA7224EB
                                        SHA1:9A08D20B993C9FB2D070D69CA8E7642DAC96DF19
                                        SHA-256:81E59D22D5EFDC2DE84C75386BF136C9E4417EB9164DECAFB4198D28F29DBA8A
                                        SHA-512:B69FACB50C0F8AC0C6E994BE16509190E57100905D6689B19F0CEBA2DCF13A9AE4EC17B2302B9214C32A25D2896AAFBEB8E9B4272E1A421B4020963AFBF87051
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./*..kKs.kKs.kKs.b3...Ks..$r.iKs..$v.~Ks..$w.aKs..$p.lKs.. w.jKs..;r.oKs.. r.bKs.kKr..Is..;w.LKs..;v.`Ks..;s.jKs..;..jKs..;q.jKs.RichkKs.................PE..L...7._...........!.....................................................................@.........................0...x.......@.......H.......................@<..H...T...................X...........@...............|............................text............................... ..`.rdata...O.......P..................@..@.data...D....`.......J..............@....qtmetad.....p.......V..............@..P.rsrc...H............X..............@..@.reloc..@<.......>...\..............@..B........................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qoffscreen.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):629232
                                        Entropy (8bit):6.802486576904191
                                        Encrypted:false
                                        SSDEEP:12288:FU09s7Ydf07Kw7AzQXSCjsBn8fztOnULj6TOZs8AADIDfEWmmPJ:Fs7q0+wIQXHsBnS4nULu6PZg
                                        MD5:E32BF024E3527CBEFCD95E5DB93BB8FC
                                        SHA1:705AC738B7AD7281F31A8197053515A87D7A5099
                                        SHA-256:E8A180285147394733DB92A532025A36824EA9416B993DFDCAA8E19A66B8B1B6
                                        SHA-512:032D5069C9E0819465C3F566D8555ABF6FE569B4B8B22E67083469F69EEF5AA03ACB99E0B42C90280AA36396AB6152A4D00A985AF5FD4C92D2428EA8ED2E7001
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u...............lv....."{.............."{......"{......"{......od..........$...od......od......od......od......od......Rich............PE..L...;._...........!.........b...............0............................................@.........................`...x...............H............~...........+..h...T...................x...........@............0...............................text...`........................... ..`.rdata..v%...0...&... ..............@..@.data........`.......F..............@....qtmetad.....p.......L..............@..P.rsrc...H............N..............@..@.reloc...+.......,...R..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qwebgl.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):407024
                                        Entropy (8bit):6.511569293536778
                                        Encrypted:false
                                        SSDEEP:6144:/Tq4StevYAunBi2Sq2DXfz3ARHh2nyPIqGfrTacq1iOCJ:/Tq4GewBrSdfODIbJ
                                        MD5:C5A4F23C2F1CB00FAC420EF89AEEBB47
                                        SHA1:2F1E73E076683C1F87081BB8EA97F007714FE8D9
                                        SHA-256:30DFC5F5614427CDA0B4C97F25C2D6D19702562EC33E49C020768288CA1BEA7A
                                        SHA-512:B67ACC32BE891CCAA2615B575D2A7B213917F3F6E78FAC28D03B76F3EB48D04AABC96AB77190ECA31FB3BCE965E53657E2D37B2B71C379B4E96D1BBFB1E3C019
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E(.T.I...I...I...1`..I...&...I...&...I...&...I..."...I...&...I...9...I..."...I...I..VJ...9...I...9...I...9...I...9...I..Rich.I..................PE..L......_...........!.........v...............................................p............@......................... \..t....\..T.......@........................a...G..T....................H......`G..@............................................text.............................. ..`.rdata...B.......D..................@..@.data...\...........................@....qtmetadz...........................@..P.rsrc...@...........................@..@.reloc...a.......b..................@..B................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platforms\qwindows.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):1219568
                                        Entropy (8bit):6.8048735134931535
                                        Encrypted:false
                                        SSDEEP:24576:JDpg2QmODTJROAxb4KHA2N8L+0C+6eCKMY3EEsBIzdCGvpzdZRE:UhwJN2NSC/glTE
                                        MD5:B2AF81698F607061986109B4A9004819
                                        SHA1:36A789F49738DE6A10BFE82A282EE7E5FEFD396B
                                        SHA-256:4D1EAF41136AC3FAEFB76F5CF2EFE8E7F8A11FD6A943A8B11F2F2A8BE5CFE19B
                                        SHA-512:1786885032C3A7F4B4D6624DC0F1365322619F6ED92417A8671FE0A36E20016E677F254DA0909395A5B4D0F4C3403072EED8C1471DC3B729CB2D687C4F78B6C4
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......q..d5..75..75..7<.y7!..7...6 ..7...6?..7...6=..7...61..7!..66..7!..64..7...61..7...6...7!..6 ..75..7...7...6|..7...64..7...74..7...64..7Rich5..7................PE..L...q._...........!.....L...R....../K.......`......................................f.....@.........................._..x...._..........H.................... ..\...t!..T....................".......!..@............`..l............................text....J.......L.................. ..`.rdata..\6...`...8...P..............@..@.data....V.......6..................@....qtmetad............................@..P.rsrc...H...........................@..@.reloc..\.... ......................@..B................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):54256
                                        Entropy (8bit):6.539788327915835
                                        Encrypted:false
                                        SSDEEP:1536:gZvYcLKYdZndpaOAmO0lu1GQ3xMesk255EUf7:YdLKYdZnWONO0luGQ3xMef255r
                                        MD5:1F0503A2A3CB332AA59CAEE30F87F91A
                                        SHA1:7865CA0B1EE0C2BAF06D354493128D9DC75EFB99
                                        SHA-256:721EC33B6907DF5621C0A1F06D35DAE91372CCF71392046DFB926DE11CB577AA
                                        SHA-512:17C8596B75323DF4684A347902AA54C9E5F12C602F9B6701A80426B4F8339F123B1136239BAD5549DFD17475148F78CE7CCE5058C2CEBF9BBBA9B00677963325
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V...................1.............1.......1.......1.......|...............|.......|.......|.a.....|.......Rich............................PE..L...?._...........!.....\...\.......c.......p............................................@......................... ...................X............................z..T....................{.......{..@............p...............................text....[.......\.................. ..`.rdata...B...p...D...`..............@..@.data...............................@....qtmetad............................@..P.rsrc...X...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\playlistformats\qtmultimedia_m3u.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):29680
                                        Entropy (8bit):6.296558865998482
                                        Encrypted:false
                                        SSDEEP:384:TWOC4NFPb0hOBHXjPL3VQ7i17hAXuXWwsP28ondDGWDgf2hyp:aKHB7LK74hXWwsP28mdDGWUf2hM
                                        MD5:EF5291D51807167542BAC67168D712FA
                                        SHA1:58ABBBD638AFC71479B846998F601ED2FA912A78
                                        SHA-256:DE588A423926B9943737E16799048A97160DFA83E4D46FF9B2278FEA1DF11D9E
                                        SHA-512:8A7AA886FB9257D7A245890852C3D0CF6DC5360F57F8BA1E4269B28807594CF040D192B8B0B2616B8400C6276BF117BBA634F522E179CF0D4511054DADAA7DC1
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...]...]...].......].e.\...]...\...].e.X...].e.Y...].e.^...].(.\...]...\.&.].(.X...].(.]...].(....].(._...].Rich..].................PE..L......_...........!.........8......P%.......0...........................................@.........................@?.......?..........X............X...............4..T....................5......05..@............0..(............................text............................... ..`.rdata..\$...0...&..."..............@..@.data........`.......H..............@....qtmetadZ....p.......L..............@..P.rsrc...X............N..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\printsupport\windowsprintersupport.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):45040
                                        Entropy (8bit):6.551151700286116
                                        Encrypted:false
                                        SSDEEP:768:xXhkTJrc5LMOqZidKxpsi5IW3y7GRepuACpdDGpzUf2hmAj:xXhkTecOKxpn5B3y7GRepuACpUzUf2j
                                        MD5:33861624E98D79EF87E1F936785E6F55
                                        SHA1:774AB45BF39289F9723363AE8819A771C67B69DF
                                        SHA-256:DC4F1C80081059AA1EC426A2D66AFD5163B04F7A3AC0AE275BF650D66894B492
                                        SHA-512:9C56AE87D2702804F4DCC8C5CAC83860F8A2F5E8C59059AB29D176E08D56B801C7E9775FC02A7C27EE14CCFC31FF64F3F50E8D2B74823EC7B48077274E56BC87
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3U'.R;t.R;t.R;t.*.t.R;tE=:u.R;tE=>u.R;tE=?u.R;tE=8u.R;t.":u.R;t.9:u.R;t.R:t(R;t.">u.R;t.";u.R;t.".t.R;t."9u.R;tRich.R;t........................PE..L...4._...........!.....L...F.......Q.......`......................................yW....@..........................r......4s..........`............................h..T....................i.......i..@............`...............................text....J.......L.................. ..`.rdata...1...`...2...P..............@..@.data...............................@....qtmetad............................@..P.rsrc...`...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):133104
                                        Entropy (8bit):6.518625487357124
                                        Encrypted:false
                                        SSDEEP:3072:Ef08LJXP50EuapXuJWd62ymc7xliHCTBIm2/40mwr6D5RXffv3xf6D:ufFRQLTBImI40mwr6D5RXffv3p6D
                                        MD5:53AF56EA898BB82775FDD0F940C429D2
                                        SHA1:5675FD1243EA87E59256B05E5A7C6C64298312EA
                                        SHA-256:547606FC8A6B20A2616A4F390C6CF0E7AA713F6AD53BAE23C8D1B021885AAB0E
                                        SHA-512:401F9B346A3DA18E750CF26CC05E1013EC8446955344D0E353012ABDCB4AF4E836515531B1BEF4C2FA5A07EC5B41A9CD74C68E39B977E43F9AD1A06AC32FA27E
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_})E>.zE>.zE>.zLF.zC>.z.Q.{G>.z.Q.{O>.z.Q.{F>.z.Q.{R>.zQU.{M>.z.N.{B>.zE>.z.?.z.N.{C>.z.N.{D>.z.N.zD>.z.N.{D>.zRichE>.z........PE..L...H._...........!.....N........../S.......`...............................0......4.....@......................... ...................X.......................8....r..T....................s.......r..@............`..`............................text....L.......N.................. ..`.rdata...r...`...t...R..............@..@.data...............................@....qtmetadm...........................@..P.rsrc...X...........................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_ar.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):160017
                                        Entropy (8bit):5.35627970915292
                                        Encrypted:false
                                        SSDEEP:1536:XGlAMfkX1M0RdaCkR8lfv8vtc8EFrVYA2I4AJZWEWgHg1C8COvzHKHC6Jp9NV0V7:XUr0RACkIwDEpV1Lgf1ubtw3Bb
                                        MD5:A7E4D0BA0FC5DF07F62CC66EC9878979
                                        SHA1:21FD131B23BDD1BBA7BBB86F3ED5C83876F45638
                                        SHA-256:E03FE68D83201543698FD7FE267DD5DFC5BFD195147E74FF2F19AC3491401263
                                        SHA-512:D9E6B10506FCF20B5B783F011908083D9DF6C5DF88E21B10D07F53A01AD6506A4B921C85335A25BAE54E27BAD7D01B6E240D58FDEEAABC7FF32014EC120C2ECF
                                        Malicious:false
                                        Preview:<.d....!..`.......arB..2....*.......+.......@.......A.......B..._...C......D.......E......F.......G... ...H...D...I...h...P...C...Q...g...R......S.......T.......U.......V...x...W......X.......Y.......]..'=...s......t...........]...........;..'....;..(....;.......;.......M..'e...O.......O...9...........}..'........C...=......m..'....t..........!o..(5...Z..+;..5u..+;..c...+O......1...!...D@...8..E@.....H4...,..HY..QI..H.......IC......J....1..J.......J.......LD......L.......PS......QR...R..R...V2..T.......U....]..X.......Zr.....[`......\....t..]x......_......._.......yg......1...6....E..8V..............C............................$..RN...[...0...,.......y.......y...................K...........9..R....E.."............z.......................%..F;...D...[..................................!....5.......0...I...0.......0...5...0..#....5.......5...p..............W}.. D..(... D..P=..+.......<U......<U......<.......H5..(...H5..P...L.......VE......VE......V....B..f...JJ..f.......f.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_bg.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):165337
                                        Entropy (8bit):5.332219158085151
                                        Encrypted:false
                                        SSDEEP:1536:9ULiyUxPoT6qx+J7FJlaaMJnxjqxq+0Uiff0mbVeb7wiEwYuYqDKBkKHMXHCIMll:9ULpIVFnpwUiEujw27ncUQUz
                                        MD5:660413AD666A6B31A1ACF8F216781D6E
                                        SHA1:654409CDF3F551555957D3DBCF8D6A0D8F03A6C5
                                        SHA-256:E448AC9E3F16C29EB27AF3012EFE21052DAA78FABFB34CD6DFF2F69EE3BD3CDB
                                        SHA-512:C6AE4B784C3D302D7EC6B9CE7B27DDAF00713ADF233F1246CD0475697A59C84D6A86BAA1005283B1F89FCC0835FD131E5CF07B3534B66A0A0AA6AC6356006B8F
                                        Malicious:false
                                        Preview:<.d....!..`.......bg_BGB../....*..,....+..."...@...]...A.......B.......C.......D...P...E...!...F.......G.......H.......I.......P.......Q.......R...A...S...e...T.......U.......V.......W...1...X...U...Y...y...]..,....s...,...t...................P...;..+....;..-E...;..!....;..+....M..,Y...O...,...O...........*...}..,............=...Q...m..,....t...|......>...(5..1...+;..<...+;..o...+O...r..1...>...D@......E@......H4......HY..[...H.......IC......J....E..J....X..J.......LD......L....L..PS......QR.."...R...`...T....X..U.......X.......Zr...q..[`...`..\.......]x......_......._....T..yg.....1...=....E..?...............L(.......(...............'...$..\....[.......,...I...y...!...y...................S...........9..]%...E..5p...........z..!q...................%..O....D..................D.....8......:......?....5...&...0.......0.. ....0...c...0..5....5.......5..................b:.. D..-... D..Z...+.......<U......<U...0..<.......H5..-...H5..[...L.......VE..#a..VE..;...V.......f...T...f...!..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_ca.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):210159
                                        Entropy (8bit):4.666388181115542
                                        Encrypted:false
                                        SSDEEP:3072:P/DVhdlafzvZfeW+6kXEVjSVPzC3ceKdP2:xYf7UW+WjwP2
                                        MD5:B383F6D4B9EEA51C065E73ECB95BBD23
                                        SHA1:DD6C2C4B4888B0D14CEBFC86F471D0FC9B07FE42
                                        SHA-256:52E94FCC9490889B55812C5433D009B44BDC2DC3170EB55B1AF444EF4AAE1D7F
                                        SHA-512:9401940A170E22CE6515E3C1453C563D93869A3C3686C859491A1F8795520B61BF3F0BFE4687A7380C0CC0C75E25559354FDB5CEF916AF4C5B6CD9661464A54A
                                        Malicious:false
                                        Preview:<.d....!..`.......caB..7....*.......+.../...@..:P...A..:t...B..:....C..:....D..;=...E..<....F..<Z...G..<~...H..<....I..<....P..>....Q..>....R..?....S..?R...T..?v...U..?....V..?....W..@....X..@<...Y..@`...]../....s..1....t..........2s......#p...;.......;../....;..W....;..e+...M../3...O.......O..9.......J....}../]......8....=..9....m../....t..9Y.......S..(5..lB..+;.._...+;...=..+O..U...1.......D@..:...E@..?...H4...J..HY..~...H..."...IC...0..J....W..J....0..J.......LD..!...L...!f..PS..)...QR.."...R.......T...9~..U...9...U...z...X...>...Zr..E...[`...e..\...LD..]x..7U.._......._...M...yg..f...1...a....E..c....7.........U.......p........b.......4.......K...$.......[.......,.......y.......y...................^...........9...:...E...s...... (...z..":.......d......!....%..tQ...D.."......."......2......ve.....y...........5..#H...0...\...0..W+...0..';...0.......5..(....5..........)s.......... D..0w.. D..}...+...1...<?..5x..<U......<U..5...<...6@..H5..0...H5..~...L...9...VE..$...V...SV..f.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_cs.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):174701
                                        Entropy (8bit):4.87192387061682
                                        Encrypted:false
                                        SSDEEP:3072:5WjuhX0CVRaakGjW9E8SSOQfX/JlwVOMxrboRPqWxXfQvO7zjBf:5iFGj1QfXr8Gd
                                        MD5:C57D0DE9D8458A5BEB2114E47B0FDE47
                                        SHA1:3A0E777539C51BB65EE76B8E1D8DCE4386CBC886
                                        SHA-256:03028B42DF5479270371E4C3BDC7DF2F56CBBE6DDA956A2864AC6F6415861FE8
                                        SHA-512:F7970C132064407752C3D42705376FE04FACAFD2CFE1021E615182555F7BA82E7970EDF5D14359F9D5CA69D4D570AA9DDC46D48CE787CFF13D305341A3E4AF79
                                        Malicious:false
                                        Preview:<.d....!..`.......cs_CZB..3p...*..F....+.......@..!....@..Ef...A..!....A..E....B.."1...B..E....C.."U...C..E....D.."....D..F....E..#p...E..F)...F..#....F..FP...G..#....G..Fw...H..$....H..F....I..$6...I..F....P..&%...P..Gr...Q..&I...Q..G....R..&....R..G....S..&....S..H....T..&....T..H8...U..'....U..H_...V..'Z...V..H....W..'~...W..H....X..'....X..H....Y..'....Y..H....]..,....]..,....s.......t...9...............*...;.......;..+....;..1B...;......;..?x...;..N....;..iY...;..s3...M..,B...M..,....O.......O...w...O..rr...........}..,j...}..-....... 5...=.. ....m..,....m..-8...t.. .......ay..(5..TT..+;...A..+;..B...+;..u...+O......+O..=a..1...a...D@.."...E@..&m..E@..G...F...J...H4...=..HY..`...H.......I...J...IC......J....-..J.......J.......LD......L....(..PS.....QR.."S..R...e...T.... ..U......X.......Zr...g..[`......\......]x......_......._......._...v...yg......1...C....E..E...............=.......Q........................s...$..a....[.......,.......y.......y...y..............G..........

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_da.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):181387
                                        Entropy (8bit):4.755193800761075
                                        Encrypted:false
                                        SSDEEP:3072:XzswP2UvZ5aZ9jFTkmq/gnBNW/+PcWrqm2Vliz0DGdaS4KSLZjwTTgwUR0toT:j3m27AjCT
                                        MD5:859CE522A233AF31ED8D32822DA7755B
                                        SHA1:70B19B2A6914DA7D629F577F8987553713CD5D3F
                                        SHA-256:7D1E5CA3310B54D104C19BF2ABD402B38E584E87039A70E153C4A9AF74B25C22
                                        SHA-512:F9FAA5A19C2FD99CCD03151B7BE5DDA613E9C69678C028CDF678ADB176C23C7DE9EB846CF915BC3CC67ABD5D62D9CD483A5F47A57D5E6BB2F2053563D62E1EF5
                                        Malicious:false
                                        Preview:<.d....!..`.......daB..4....*..h....+......@...f...A.......B.......C.......D...U...E.......F...v...G.......H.......I.......P.......Q.......R...6...S...Z...T...~...U.......V.......W..."...X...F...Y...j...]..+....s.......t..................-...;..+....;..,....;../....;..;....M..+....O.......O...r...........}..,............=...8...m..,0...t...c......T...(5..B...+;..NH..+;..~H..+O..,...1...UP..D@......E@......H4...E..HY..j...H.......IC...#..J....J..J.......J.......LD......L....1..PS...B..QR......R...o...T.......U.......X.......Zr......[`...W..\....}..]x...[.._....-.._.......yg...e..1...O....E..R....7..........-!......]............................$..k....[...7...,.......y...c...y.................j4...........9..l8...E..p............z...;..................%..a....D...~.............-.....L......OH.....Uz...5.......0.......0...U...0.......0..p....5...7...5..L$..............p... D..-... D..i...+....@..<U.....<U.....<....S..H5..-2..H5..j$..L....B..VE.. ...VE..P...V...*...f...e...f.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_de.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):220467
                                        Entropy (8bit):4.626295310482312
                                        Encrypted:false
                                        SSDEEP:3072:7w8go8+ph6JVB8XVXYWpSNEeg8+vaD+p4N8DDiEKugwGZulh15ce4M+4NsPYXCZW:88h8Sj286tTiDD
                                        MD5:40760A3456C9C8ABE6EA90336AF5DA01
                                        SHA1:B249AA1CBF8C2636CE57EB4932D53492E4CE36AC
                                        SHA-256:553C046835DB9ADEF15954FA9A576625366BA8BFD16637038C4BCD28E5EBACE1
                                        SHA-512:068E55F39B5250CC937E4B2BD627873132D201D351B9351BE703CD9B95D3BAFB4BD649CB4DF120A976D7C156DA679758D952CAC5E0523107244E517D323BC0C5
                                        Malicious:false
                                        Preview:<.d....!..`.......de_DEB..7....*.......+..3....@..R....A..R....B..S....C..S@...D..S....E..T]...F..T....G..T....H..T....I..U#...P..W....Q..W6...R..W....S..W....T..W....U..W....V..XG...W..Xk...X..X....Y..X....]..2%...s..J$...t..9R......J.......B....;..1....;..3....;..q....;.......M..2O...O.......O..X@......ia...}..2y......Q....=..Q....m..2....t..Q...........(5......+;..ev..+;......+O..oh..1....4..D@..R...E@..WZ..H4..4...HY...[..H...AY..IC..>o..J...>...J.......J...>6..LD..@A..L...@...PS..I...QR..#...R....h..T...W...U...Xh..U....~..X...]...Zr..e(..[`..)...\...j...]x..O..._....K.._...lI..yg...U..1...f....E..i....7..........o.......wG......6.......6.......8....$...n...[..8....,..9....y.......y..=................3......>....9.......E..."......?_...z..#d.......0......A%...%..z....D..A.......B......KP......2.............^...5..B....0.......0..p....0..F....0...}...5..G....5..........H........... D..3}.. D...O..+...Q...<?..Ti..<U......<U..T...<...U)..H5..3...H5......L...X...VE..%j..V...l..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_en.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):16
                                        Entropy (8bit):4.0
                                        Encrypted:false
                                        SSDEEP:3:j2wZC4n:CwZ
                                        MD5:BCEBCF42735C6849BDECBB77451021DD
                                        SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                        SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                        SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                        Malicious:false
                                        Preview:<.d....!..`...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_es.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):165170
                                        Entropy (8bit):4.679910767547088
                                        Encrypted:false
                                        SSDEEP:1536:JVwzuvb+Ta64KQd84arHX5pxiVhA8QlOD/BnFNa8NsvsfFsfcoZtIx6F:JVwSTG4KqVaLX5pEVK7OJFczstgRtIx8
                                        MD5:C7C58A6D683797BFDD3EF676A37E2A40
                                        SHA1:809E580CDBF2FFDA10C77F8BE9BAC081978C102B
                                        SHA-256:4FFDA56BA3BB5414AB0482D1DDE64A6F226E3488F6B7F3F11A150E01F53FA4C8
                                        SHA-512:C5AED1A1AA13B8E794C83739B7FDDEAFD96785655C287993469F39607C8B9B0D2D8D222ECD1C13CF8445E623B195192F64DE373A8FB6FE43743BAF50E153CDA5
                                        Malicious:false
                                        Preview:<.d....!..`.......es_ESB../....*..*,...+...y...@.......A.......B.......C.......D...v...E...=...F.......G.......H.......I.......P.......Q... ...R...k...S.......T.......U.......V...1...W...U...X...y...Y.......]..+....s.......t...................c...;..+....;..,....;...%...;..#....;..-....M..+....O.......O...............}..,............=...]...m..,/...t..........A...(5..3...+;..<...+;..o...+O..!b..1...Ap..D@......E@...D..H4...-..HY..[F..H.......IC...%..J....L..J.......J.......LD......L....O..PS......QR..!...R...`K..T.......U....&..X.......Zr.....[`...h..\......]x...|.._....Y.._....A..yg......1...=....E..?a......!.......K........G...............R...$..\Q...[.......,...z...y.......y..................+............9..\....E..2............z.. ....................%..ON...D........................:......=B.....A....5...7...0.......0......0.."....0...,...0..3....5...}...5...Y..............a... D..-!.. D..Z6..+....0..<U...h..<U......<.......H5..-M..H5..Z...L.......VE.."...VE..>...V......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_fi.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):179941
                                        Entropy (8bit):4.720938209922096
                                        Encrypted:false
                                        SSDEEP:3072:lvdTgO2Yl97ZWnbgTLt/Tf9IlqAeiy5uWkYGM0wNCdRjSK2YUlUs:lvdkA9vh5uWkY0MK2YXs
                                        MD5:8472CF0BF6C659177AD45AA9E3A3247C
                                        SHA1:7B5313CDA126BB7863001499FB66FB1B56C255FC
                                        SHA-256:E47FE13713E184D07FA4495DDE0C589B0E8F562E91574A3558A9363443A4FA72
                                        SHA-512:DE36A1F033BD7A4D6475681EDC93CC7B0B5DCB6A7051831F2EE6F397C971B843E1C10B66C4FB2EFF2A23DC07433E80FBF7B95E62C5B93E121AB5AD88354D9CB8
                                        Malicious:false
                                        Preview:<.d....!..`.......fiB..38...*..ct...+......@.......A.......B.......C...@...D.......E...]...F.......G.......H.......I...#...P.......Q...6...R.......S.......T.......U.......V...G...W...k...X.......Y.......]..*....s...T...t.......................;..*....;..+....;..&....;..3....M..+!...O.......O...e...........}..+K...........=.......m..+w...t..........J...(5..9...+;..:y..+;..mW..+O..$...1...KY..D@......E@...Z..H4...l..HY..X&..H.......IC......J.......J...."..J......LD.....L.......PS...'..QR.. L..R...]...T.......U.......X.......Zr......[`......\.......]x......_....k.._....>..yg.. /..1...;....E..>....7..{(......%.......J........T.......&.......U...$..Y[...[......,...s...y.......y...a.......}......d...........9..Y....E..k'...........z...........V..........%..M....D...Q.......{......d.....A......E......K....5.......0.......0..&J...0.......0..k....5...*...5..I9.............._:.. D..,O.. D..W...+....9..<U...G..<U...*..<.......H5..,y..H5..W...H5......L....5..VE..!u..VE..E...V..."{..f.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_fr.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):166167
                                        Entropy (8bit):4.685212271435657
                                        Encrypted:false
                                        SSDEEP:1536:CLZ1w8McowCppcPwL5pYFw+G00QsbLckCiWxvq+sjs06oFm:C91wxcowspc4L5pUw+cz39CiQ7tloFm
                                        MD5:1F41FF5D3A781908A481C07B35998729
                                        SHA1:ECF3B3156FFE14569ECDF805CF3BE12F29681261
                                        SHA-256:EDB32A933CEF376A2636634E14E2977CED6284E4AA9A4AC7E2292F9CA54C384A
                                        SHA-512:A492E8AC88095A38A13549C18C68E1F61C7054AB9362C2B04C65B93E48E4A07941C8DA6950BAE79041094623E0ED330CA975110FDE8248B4D9380B9F729AD891
                                        Malicious:false
                                        Preview:<.d....!..`.......fr_FRB../....*..-....+.......@.......A.......B.......C...?...D.......E...\...F.......G.......H.......I..."...P.......Q...5...R.......S.......T.......U.......V...F...W...j...X.......Y.......]..+....s...=...t.......................;..+....;..,....;.......;..$b...;.......M..,....O.......O...5...........}..,3...........=.......m..,]...t..........A...(5..5j..+;..<T..+;..o...+O.."+..1...B\..D@......E@...Y..H4...8..HY..[{..H.......IC......J.......J.......J.......LD...|..L.......PS...?..QR..!...R...`j..T.......U....[..X.......Zr.....[`...)..\......]x......_....7.._.......yg...i..1...=Q...E..?@......"Y......K............................$..\....[...^...,...'...y.......y...+.......o....../c.......Y...9..\....E..6(...........z..!................j...%..OC...D...+.......[......a.....;......>......B....5.......0.......0...m...0..#....0.......0..6....5.......5..................a... D..-Y.. D..Ze..+....]..<U...;..<U......<.......H5..-...H5..Z...L.......VE.."...VE..?...V......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_gd.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):189580
                                        Entropy (8bit):4.630160941635514
                                        Encrypted:false
                                        SSDEEP:1536:SiaI3C87jhakhR0VGkw7ys7CskUH6y4e6IFB4xyMuhvDnJGhFaCo527arBbm07LZ:S2yGjh17yGqxTXhvQoejJd8FUjVgk
                                        MD5:EB1FB93B0BE51C2AD78FC7BA2F8B9F42
                                        SHA1:24F7FF809E2F11C579CD388FEA5A4C552FF8D4D0
                                        SHA-256:63B439DD44139AA3AED54C2EBE03FA9BC77F22C14ED8FBA8EFF2608445BB233D
                                        SHA-512:E13770AEF33B6666ED7D54E03EE20CA291D4167D673BA6C61D8E64CDD5F7FFE0A9521B95AF67BE719BF263932ECF16E2B2D0B5F3404F9BCD7879114FCC6FC474
                                        Malicious:false
                                        Preview:<.d....!..`.......gd_GBB..2....*...u...+......@.......A...B...B.......C.......D.. ....E.. ....F..!&...G..!J...H..!n...I..!....P..#m...Q..#....R..#....S..$....T..$$...U..$H...V..$....W..$....X..$....Y..%....]../....s...'...t...................F...;.......;../....;..=V...;..G....M../G...O.......O...k......$....}../o.......i...=.......m../....t..........[...(5..M...+;..@...+;..x...+O..:...1...\7..D@...f..E@..#...H4...p..HY..be..H.......IC......J.......J....R..J.......LD......L.......PS......QR..#l..R...g...T.......U.......X....\..Zr......[`......\...&...]x......_....C.._...'t..yg..?...1...BM...E..D.......;.......R'.......t.......@.......?...$..c....[......,...i...y.......y...Y.......f.......+...........9..c....E...............z.."....................%..U....D..................G.....UB.....W......\]...5.......0.......0..<....0...;...0.......5.......5..ij..............h... D..0... D..aC..+....K..<U.....<U...~..<.......H5..0...H5..a...L....1..VE..$...VE..X...V...8|..f...Z...f...=..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_he.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):138690
                                        Entropy (8bit):5.515748942553918
                                        Encrypted:false
                                        SSDEEP:3072:XSue8Z7T3iJsqBejt/zNHSLzdetY2ZISfC/S:XSueK3w7Ijt8zUtYAISfC/S
                                        MD5:DEAF87D45EE87794AB2DC821F250A87A
                                        SHA1:DB39C6BAA443AA9BB208043EF7FB7E3403C12D90
                                        SHA-256:E1EBCA16AFE8994356F81CA007FBDB9DDF865842010FE908923D873B687CAD3F
                                        SHA-512:276FCE81249EFFE19E95607C39F9ACB3A4AFA3F90745DA21B737A03FEA956B079BCA958039978223FD03F75AC270EC16E46095D0C6DDA327366C948EC2D05B9C
                                        Malicious:false
                                        Preview:<.d....!..`.......he_ILB../....*......+..Sw...@......A......B.......C.......D...X...E.......F.../...G...O...H...o...I......P.......Q.......R...I...S...i...T......U......V.......W.......X.../...Y...O...]..$....s......t..X:.......4......`Y...;..$....;..%....;.......;...5...;.......M..$....O...6...O..s............}..%-...........=...m...m..%k...t..........^..(5......+;..2...+;..^...+O...N..1.......D@......E@...(..H4..T...HY..L...H..._...IC..\...J...\...J.......J...\j..LD..^...L...^o..PS..fl..QR......R...Q...T...su..U...s...X...x3..Zr..~...[`..L\..\.......]x....._......._....o..yg...(..1...3....E..5C.......z......?V......U.......U.......W....$..M....[..W....,..X....y.......y..\........a..............\@...9..NO...E...?......]s...z...G.......(......^....%..B^...D.._......._.................... ..........5..`/...0.......0...L...0......0..d(...0......5..ek...5..........fB......R... D..&O.. D..K...+...l...<U......<U..p)..<...p...H5..&w..H5..La..L...s...VE......VE......V.....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_hu.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):160494
                                        Entropy (8bit):4.831791320613137
                                        Encrypted:false
                                        SSDEEP:3072:BmOMZadV9n51xXeQvjOiIzz7/Vs9Db3ihuJNvMfWxBNlYzYbTrIkfwb03l24cNKu:HkWa5pg0MahBHDd
                                        MD5:E9D302A698B9272BDA41D6DE1D8313FB
                                        SHA1:BBF35C04177CF290B43F7D2533BE44A15D929D02
                                        SHA-256:C61B67BB9D1E84F0AB0792B6518FE055414A68E44D0C7BC7C862773800FA8299
                                        SHA-512:12947B306874CF93ABA64BB46FAC48179C2D055E770D41AF32E50FFFB9F0C092F583AFCEA8B53FE9E238EF9370E9FFFBEB581270DFA1A7CB74EBE54D9BFF459F
                                        Malicious:false
                                        Preview:<.d....!..`.......hu_HUB../....*.......+.......@.......A...0...B...{...C.......D.......E.......F.......G...<...H...`...I.......P...s...Q.......R.......S.......T...*...U...N...V.......W.......X.......Y.......]..+y...s.......t.......................;..+Q...;..,U...;.......;.......;..&....M..+....O.......O...U..........}..+............=.......m..+....t..........9c..(5..,...+;..;...+;..m7..+O......1...9...D@...T..E@......H4...v..HY..Y...H.......IC......J.......J.......J.......LD......L.......PS...}..QR..!...R...]...T.......U....{..X.......Zr...=..[`......\....*..]x...-.._......._......yg...M..1...<....E..>...............J........T.......(.......S...$..Z....[.......,...u...y.......y...[...............#...........9..Z....E..#&...........z..!'...................%..Mv...D..._....................32.....5......9....5.......0...h...0...E...0.......0.......0..#....5...Z...5...........G......_2.. D..,... D..W...+....W..<U......<U...B..<.......H5..,...H5..X{..L....)..VE.."...VE..6l..V....*.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_it.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):161172
                                        Entropy (8bit):4.680034416311688
                                        Encrypted:false
                                        SSDEEP:1536:eSfxfdO4BKJb0td5pqCOIUP/PFIM7gxGQ9sRrFM6QJ4m8ihkM:eSfxFO4BKJb0td5pnOrvCqg9mRK4IkM
                                        MD5:88D040696DE3D068F91E0BF000A9EC3E
                                        SHA1:F978B265E50D14FDDE9693EC96E99B636997B74D
                                        SHA-256:7C7DC8B45BF4E41FEC60021AB13D9C7655BE007B8123DB8D7537A119EB64A366
                                        SHA-512:F042637B61C49C91043D73B113545C383BD8D9766FD4ACC21675B4FF727652D50863E72EA811553CB26DF689F692530184A6CE8FE71F9250B5A55662AFE7D923
                                        Malicious:false
                                        Preview:<.d....!..`.......it_ITB../....*.......+.......@.......A..."...B...m...C.......D.......E.......F.......G...0...H...T...I...x...P...q...Q.......R.......S.......T...(...U...L...V.......W.......X.......Y.......]..+....s...'...t...................^...;..+[...;..,g...;.......;.......;..!B...M..+....O...D...O...........(...}..+........I...=.......m..,....t..........4...(5..'...+;..<...+;..oV..+O......1...5...D@...F..E@......H4...J..HY..Z...H.......IC...L..J....s..J....j..J.......LD......L....f..PS......QR..!...R..._...T.......U....3..X.......Zr......[`...Q..\.......]x......_......._....0..yg...C..1...=....E..?o..............Kf.......h.......8.......I...$..[....[.......,...m...y...9...y...........z.......z...........9..\=...E..$u.......:...z.. k...................%..N....D..................M............0......5/...5...2...0.......0...0...0...A...0...)...0..$....5.......5...J.......a......a... D..,... D..Y...+.......<U......<U......<....v..H5..-...H5..Z...L.......VE.."c..VE..1...V....X.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_ja.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):129911
                                        Entropy (8bit):5.802855391832282
                                        Encrypted:false
                                        SSDEEP:1536:W8YYSCjKBJ26c1Z7f25pVmuLXpxfqt7FEUWNrfQje9kWI23pKXvx:xYuKBJ01Z7u5pQuLbESUWNzAAI23pKfx
                                        MD5:608B80932119D86503CDDCB1CA7F98BA
                                        SHA1:7F440399ABA23120F40F6F4FCAE966D621A1CC67
                                        SHA-256:CBA382ACC44D3680D400F2C625DE93D0C4BD72A90102769EDFD1FE91CB9B617B
                                        SHA-512:424618011A7C06748AADFC2295109D2D916289C81B01C669DA4991499B207B781604A03259C546739A3A6CF2F8F6DFA753B23406B2E2812F5407AEE343B5CBDD
                                        Malicious:false
                                        Preview:<.d....!..`.......jaB../....*...'...+..=....@.......A.......B...?...C...c...D......E......F.......G.......H..."...I...F...P.......Q...'...R...r...S......T......U.......V...8...W...\...X......Y......].."k...s...Q...t..A...............I....;.."C...;..#A...;.......;.......;.......M.."....O...B...O..[?......h....}.."........m...=.......m.."....t...........M..(5......+;......+;..WU..+O......1.......D@......E@...K..H4..>=..HY..F...H...Hr..IC..E...J...F...J.......J...E...LD..Gz..L...G...PS..O...QR......R...K!..T...Z...U...[e..X..._f..Zr..e...[`..7...\...i...]x...'.._......._...j...yg..~+..1.../....E..1?.......#......:.......?.......?n......A....$..G....[..Ap...,..B....y.......y..Ew......|...............E....9..H....E..........F....z...]..............HL...%..=R...D..H.......I!......[......J......M..........5..It...0...3...0.......0...C...0..M....0...a...5..N....5..........N.......L6.. D..#... D..E...+...U%..<U......<U..X ..<...X...H5..#...H5..FK..L...[...VE......VE......V......f.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_ko.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):156799
                                        Entropy (8bit):5.859529082176036
                                        Encrypted:false
                                        SSDEEP:1536:rvTy18hhPekHs1iNXVExWbStnn8TExgkYOvYejZOvXx4Mmf0MwUL8smk/pDZyy:y18hJ61nMStnn8TOgknQRLWZmkxNyy
                                        MD5:082E361CBAC2E3A0849F87B76EF6E121
                                        SHA1:F10E882762DCD2E60041BDD6CC57598FC3DF4343
                                        SHA-256:0179ED1B136E1CB3F583351EAA2C545BA3D83A6EE3F82C32505926A1A5F5F183
                                        SHA-512:F378A42116924E30FA0B8FFF1D3C3CB185DC35B2746DCE2818BE7C2AA95C5DE103DF44AAC74DA969C36C557F1D4DE42AC7647EC41066247F8AD2697BDED667EA
                                        Malicious:false
                                        Preview:<.d....!..`.......koB..7....*.......+.......@...K...A...o...B......C.......D...8...E.......F...U...G...y...H......I.......P......Q.......R.......S...C...T...g...U.......V.......W.......X...-...Y...Q...]..$....s...>...t...................y...;..${...;..%....;...u...;...l...M..$....O.......O...8...........}..$............=...C...m..%!...t...n..........(5...a..+;..E@..+;..l|..+O......1.......D@.....E@......H4......HY..\...H....]..IC......J.......J....8..J.......LD...a..L.......PS......QR......R...`...T.......U....^..U.......X....y..Zr......[`..y...\....A..]x......_......._....o..yg......1...FJ...E..HE...7..................Q........a.......5...........$..]....[...;...,.......y.......y...V...............!.......|...9..]....E...R...........z...4.......f.......5...%..Te...D..................D......^.............*...5...S...0.......0.......0.......0.......5.......5...........n......a... D..%... D..[...+.......<?......<U...;..<U...+..<.......H5..&...H5..\...L.......VE......V....A..f.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_lv.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):153608
                                        Entropy (8bit):4.843805801051326
                                        Encrypted:false
                                        SSDEEP:3072:y5pmbKIhooMbGe91MrjOhmGzP6LJbWz5XIxELpU6:yObeqrjPGzeJyJLy6
                                        MD5:BD8BDC7BBDB7A80C56DCB61B1108961D
                                        SHA1:9538C4D8BB9A95C0D9DC57C7708A99DD53A32D1F
                                        SHA-256:846E047573AE40C83671C3BA7F73E27EFC24B98C82701DA0DF9973E574178BB2
                                        SHA-512:F040EC410EBFEA21145F944E71ADCAE8E5F60907D1D3716A937A9A59A48F70C6B7EAAC91C2C554F59357A7BC820CDBD17C73A4DECC20B51F68EB79EDD35C5554
                                        Malicious:false
                                        Preview:<.d....!..`.......lv_LVB.......*...B...+..y....@.......A...=...B......C......D.......E.......F...#...G...G...H...k...I.......P...~...Q......R.......S.......T...5...U...Y...V......W.......X.......Y.......]..%....s.......t...8.......n.......A...;..&....;.......;...!...;...A...;../....M..%....O.......O...............}..%...........=.......m..&....t...(......(g..(5...+..+;..4...+;..d...+O......1...(...D@...a..E@......H4..z...HY..Q...H.......IC......J....6..J.......J.......LD......L....9..PS......QR......R...U...T....S..U.......X...._..Zr......[`..r...\.......]x...*.._......._....{..yg......1...5v...E..7........(......B.......|.......|W......~r...$..R....[..~....,.......y...l...y...............................9..S....E...g...........z...z...................%..F....D........................"Z.....$......)....5.......0...\...0.......0...r...0.......0.......5...a...5..........J......V... D..&... D..P...+.......<U......<U......<.......H5..'"..H5..P...L....~..VE...R..VE..%...V......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_pl.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):162982
                                        Entropy (8bit):4.841899887077422
                                        Encrypted:false
                                        SSDEEP:1536:sXpestp/YIFtDT8FIWYbIJmPYuIpnmxAk6mwyJNqSm9+P:sxpTDT8FIWfJmdCmxApmbnqSm9+P
                                        MD5:F9475A909A0BAF4B6B7A1937D58293C3
                                        SHA1:76B97225A11DD1F77CAC6EF144812F91BD8734BD
                                        SHA-256:CE99032A3B0BF8ABAD758895CC22837088EAD99FD2D2514E2D180693081CFE57
                                        SHA-512:8A4F1B802B6B81FF25C44251FB4A880E93E9A5FE25E36825A24BFE0EFB34E764E7E1EE585D3A56554964B7921E7813C67F12D200D6E0C5EAF4BB76B064B5C890
                                        Malicious:false
                                        Preview:<.d....!..`.......pl_PLB..0....*.."....+.......@...F...A...j...B......C.......D...3...E.......F...P...G...t...H.......I.......P.......Q.......R.......S...>...T...b...U.......V.......W.......X...(...Y...L...]..*....s.......t...r.......o.......+...;..*....;..+....;..."...;... ...M..*....O...6...O...........a...}..+...........=.......m..+G...t...G......,...(5......+;..:...+;..k...+O......1...-[..D@.....E@......H4...U..HY..WU..H.......IC......J....6..J.......J.......LD......L....%..PS......QR.. ...R...[...T....1..U.......X......Zr......[`......\.......]x...A.._......._....}..yg......1...;W...E..=........%......H....................$..Xp...[.......,.......y...i...y...........}......$R...........9..X....E..+)...........z.. E...................%..K....D...p....................&......(......-....5.......0.......0...e...0.......0..+....5...]...5...........f......]-.. D..,%.. D..V?..+....V..<U......<U......<....-..H5..,M..H5..V...L....Z..VE..!...VE..)...V.......f...P...f....K..f......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_ru.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):203767
                                        Entropy (8bit):5.362551648909705
                                        Encrypted:false
                                        SSDEEP:1536:hn4dEJ63pdhPpy6gu5fs4MHQv6sLlxnrncF423ZL9xyuXwdcX8LZuf76CW+WeXFx:aN3pdV5fZbpItXsttRY+WSq
                                        MD5:5096AD2743BF89A334FBA6A2964300D4
                                        SHA1:405F45361A537C7923C240D51B0FF1C46621C203
                                        SHA-256:3DA6605668F9178D11A838C4515478084DCFB4F9CF22F99D7A92B492DB9C224B
                                        SHA-512:7B88B501792B5831426BAA669138192ED94CC3F8323A3DF9D5287655DC4D877706908C517AB7523AE8A283BF50B47123F13B8AE40EA2F3081C3459EDC47FC8DD
                                        Malicious:false
                                        Preview:<.d....!..`.......ru_RUB..7....*...L...+...W...@..,....A..,....B..-1...C..-U...D..-....E...r...F.......G.......H../....I../8...P..1'...Q..1K...R..1....S..1....T..1....U..2....V..2\...W..2....X..2....Y..2....].......s..$c...t...'......%........r...;..-....;.......;..J....;..V....M...C...O.......O..&.......8....}...m......+3...=..+....m.......t..+.......p...(5..]@..+;..[0..+;......+O..H...1...qM..D@..-...E@..1o..H4...p..HY..xm..H....*..IC...@..J....g..J.......J.......LD......L....p..PS......QR..!...R...}...T...&...U...'...U...ki..X...+...Zr..3...[`......\...:...]x..)..._......._...;...yg..S...1...\....E..__...7.........H.......k................j.......U...$..y....[.......,.......y...k...y...............................9..y....E...O...........z..!*...................%..nW...D.................%w.....g......j~.....qw...5...H...0.......0..I....0..._...0......5.......5..................~... D../k.. D..wa..+....?..<?.."t..<U......<U.."...<...#z..H5../...H5..w...L...&...VE.."...V...F$.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_sk.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):125763
                                        Entropy (8bit):4.80343609423322
                                        Encrypted:false
                                        SSDEEP:3072:roXDuC1u/2lUBGjJirE5tsd/aev1GIfOdvhw:OucMGjH5tbm
                                        MD5:3D60E50DCBCBD70EE699BC9B1524FCB9
                                        SHA1:0211B4911B5B74CC1A46C0FCA87D3BF5632AA44A
                                        SHA-256:D586AE2C314074CF398417FDECB40709D5478DFEB0A67C2FE60D509EE9B59ED7
                                        SHA-512:F98211867F1DBCB8A342C00E23FA5718BE6E999F7449CB8470B41BF0F527C7F78CC4D6666E28968F32E96026907156753979BFADA7E6BF4225D02A902D24906D
                                        Malicious:false
                                        Preview:<.d....!..`.......sk_SKB..$x...*.......+..>....@......A......B.......C.......D...3...E...Z...F......G......H.......I.......P.......Q...D...R.......S......T.......U.......V...1...W...X...X.......Y......]...Y...t..D-......K....;...3...;.......;.......;......;...V...M.......O.._ ......l....}.......m...........T..(5...(..+;......+;..%...+O......1......E@...k..F.......H4..?I..HY..@7..H...J...I....,..IC..HT..J...H{..J...H...LD..J"..L...Jv..PS..Q...R...D...Zr..i]..[`..7...\...nB.._...o...1...&....E..(........B......19......A.......A....$..AF...[..C....,..D....y..G.......v........g......G....9..A....E..........IH...%..4.......Kf..............................5..K....0...,...0.......0.......0..Of...0.......5..P....5..........E... D...C.. D..?'..+...Y`..<U......<U..\...<...]...H5...m..H5..?...L...^...VE......f.......f...8...g.......l...aP.......................6......d....D..f(...`..f...............?....`..h5...y..H....5..j........E...e.......e..@....... ......>......oZ......l..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_tr.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):194487
                                        Entropy (8bit):4.877239354585035
                                        Encrypted:false
                                        SSDEEP:3072:yRRhAFCvqDBitD/iDG9AOH+l4TcwZBPqHo9fd9CFRK+2IKAimxsjucV2p0ZqvRu7:yRRHs5mksWVX3lA3
                                        MD5:6CBC5D8E1EABEC96C281065ECC51E35E
                                        SHA1:4E1E6BA3772428227CB033747006B4887E5D9AD1
                                        SHA-256:6A0BF6E70E7920C2B193E76E92F78F315936955D3B06AC039D917F2E06C43281
                                        SHA-512:CE1F9EE180176153D5F523D71E0DB06F4DEA65C24E5E2CD56341CFAEE349A8E9A0F606D99F7219A35DD4516D1528C90AEA4BB87548A55392B8F2B36164D478B1
                                        Malicious:false
                                        Preview:<.d....!..`.......tr_TRB..7....*.......+...-...@.......A.......B.......C...%...D.......E...F...F.......G.......H.......I.......P.. ....Q.. ....R..!D...S..!h...T..!....U..!....V.."....W.."0...X.."T...Y.."x...]..,g...s.../...t......................;..,9...;..-I...;..9@...;..E....M..,....O.......O...G...........}..,............=...\...m..,....t.........._3..(5..LJ..+;..Wt..+;...\..+O..7...1..._...D@......E@..!...H4...@..HY..t...H....2..IC...r..J......J....D..J....K..LD...$..L....x..PS......QR..!...R...x...T.......U....q..U...Y...X...."..Zr...%..[`......\....:..]x......_......._.......yg..6...1...X....E..[....7...Z......7Q......f............................$..u....[...:...,...5...y.......y...........7...............!...9..u....E...........P...z.. ........p...........%..j....D..................A.....U......Y......_....5...V...0.......0..8....0...U...0.......5.......5..~b..............z+.. D..-... D..s...+.......<?...8..<U...s..<U...p..<.......H5..-...H5..s...L.......VE.."0..V...4..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_uk.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):158274
                                        Entropy (8bit):5.402056706327934
                                        Encrypted:false
                                        SSDEEP:1536:jXwjFVUDdMUD4TzdAhpQgO5poZHvJllEnhmdK4I77/dnPJX/imfb1jhvv3BxT8ue:jBzD4Tzaw5pCvJ8hVPdlvj3p8
                                        MD5:D6234E4E21021102B021744D5FA22346
                                        SHA1:63A14327D0CF0941D6D6B58BFA7E8B10337F557B
                                        SHA-256:51B8FF55B37DC5907D637A8DDDA12FBE816852B0244C74EB4F0FB84867A786E0
                                        SHA-512:37D24A092C5F29BACB7A4CA8207C4EEFD0F073B7E74A492402867F758084091BF1D79D2BA2B4A28B35FEF42E8023C371FDE97578F74BB2033551154E77102DE6
                                        Malicious:false
                                        Preview:<.d....!..`.......uk_UAB../....*...E...+...l...@.......A.......B...G...C...k...D.......E.......F.......G.......H...*...I...N...P...=...Q...a...R.......S.......T.......U.......V...r...W.......X.......Y.......]..*y...s.......t...........;.......n...;..*Q...;..+U...;.......;...x...;..!(...M..*....O.......O...........6...}..*........E...=.......m..*....t..........3...(5..&...+;..:...+;..k0..+O...A..1...4-..D@... ..E@......H4...8..HY..W...H....2..IC...V..J....}..J.......J....%..LD...&..L....z..PS......QR.. ...R...\...T....(..U.......X.......Zr......[`..~...\.......]x......_......._....4..yg...c..1...;....E..=w.......m......I............................$..X....[...<...,.......y.......y...........M...................9..Y....E...F.......D...z.. ........P...........%..LB...D.......................-n...../......4W...5...F...0...p...0...W...0.......0...k...0.......5.......5..................^... D..+... D..V...+.......<U.../..<U......<....>..H5..+...H5..V...L....S..VE..!...VE..0...V......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtbase_zh_TW.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):127849
                                        Entropy (8bit):5.83455389078597
                                        Encrypted:false
                                        SSDEEP:3072:Fv2cHP10gOs6dcFxsJopMqOWv2WIrPFP8pa:Fh6s6iFxEodjef8pa
                                        MD5:9C6A3721D01ECAF3F952CE96F46CE046
                                        SHA1:4A944E9E31DF778F7012D8E4A66497583BFD2118
                                        SHA-256:085D29EAF9BBB788B2F2503D74A1EF963A9411CEB600441254CE49A120E1AB63
                                        SHA-512:6E2807B8785F42A26C9CCBDBA0327DD40B529B10C468593F0E74113774D1CCDAA4FD9ACE9B259B9040E1475911428ECAEA49425B0F170862CF8147D23DB48E46
                                        Malicious:false
                                        Preview:<.d....!..`.......zh_TWB..2x...*.......+..)....@.......A.......B...j...C......D.......E......F.......G...)...H...M...I...q...P...%...Q...I...R......S......T.......U.......V...Z...W...~...X......Y.......]..!....s.......t..-...............4....;..!z...;.."|...;.......;.......M..!....O.......O..Ay......N)...}..!............=.......m.." ...t...(.........(5......+;..;...+;.._...+O......1.......D@...C..E@...m..H4..*W..HY..Pm..H...3...IC..1...J...1...J.......J...1...LD..2...L...38..PS..6...QR...T..R...T...T...A...U...A...X...E...Zr..K...[`..$...\...OW..]x......_......._...P...yg..a^..1...<....E..>....7...>.......;......Fo......+.......+.......-L...$..QR...[..-....,...F...y.......y..1J...............6......1p...9..Q....E..........2....z...........<......3....%..H....D..4W......4}....................Z...... ...5..4....0...?...0...K...0..5....0...L...5..6....5..........6.......U... D.."... D..O...+...<%..<U......<U..>...<...?:..H5..#...H5..O...L...AS..VE...M..VE......V.......f...L..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_ar.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):11486
                                        Entropy (8bit):5.268991075562103
                                        Encrypted:false
                                        SSDEEP:192:20UQRn2sg91xzuera9bIWo6P5qIJtzi82337ui:2ri2sgj6E6P5qizPWLui
                                        MD5:C0A0146E0F690E7CFFF468D9D2B23BF8
                                        SHA1:4649CDF3C53E6012810F44D8A8903EE7606F4B35
                                        SHA-256:5FC10414E168C1161B8590A5C173D140D31B17CF450F0AC93E666EBF7A2FF908
                                        SHA-512:6AA319C3CC6CEC5F6F06BDAE653F97E6B31D49DEB012DB84EE816DE5A6FFD0DD7A1395A8D387557081D87A6D54BE31EE8083A13B6BCB030CEAF4D7247701DC22
                                        Malicious:false
                                        Preview:<.d....!..`.......arB.....X.A..#.................Q.......R.....H.W.>.........%....1..#h.C|......OY....I.c....'k..]>...k..]>...M..................t..&F................|......W.......[C......p....%...#..."....n..........!..................zn......*......:.....@.C......w\^...X.............)...TD...g..T................N.....q3....z...........U.......T..............b........1..........."...............e.........c.....I.l.E.....l.E...C.l.E..)...6...'............a..$x. ^>.........!Y...... -......>............(>.#......K.s......s....t......'...n...A....&...Z..............X5A.....q.C.....x.....9...^...G...N......L.......M..."I......B.......P.w. .....};...._...... ........)..J....|.........?.............|....(...Q5..._..KT...ri..).....6.F.3.B. .E.D.A.Q.'.*. .R.A.W. .(.(.D.'. .*.1.H.J.3.).)..........RAW (headerless) file format.....AudioContainerControl.......F.3.B. .E.D.A.Q.'.*. .W.A.V..........WAV file format.....AudioContainerControl.....0.(.J.'.F.'.*. .P.C.M. .5.H.*.J.Q.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_bg.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):13683
                                        Entropy (8bit):5.206041252254424
                                        Encrypted:false
                                        SSDEEP:384:rcVs16vrAWygoSWLyZ5aQVa3A3mMa83DB3eAsk:rcVs16vrAWyoWuZ5aQVa3A2Maq93eAsk
                                        MD5:15EA6B38E1EF62ABC6AE030ED6C665DB
                                        SHA1:4F541734690E100747A99D259D2DAB948BE0D68A
                                        SHA-256:ADD8675FBC2351FB6C8397ED36932F98553782DD4CE0498EFC5B89B050AC8626
                                        SHA-512:B34A1465E59F156F87879F83BA350AE7D632CE246C079BDE2976ED53B6DC6CDED1989CF6C80F53CA94498AD3EC8E573F0B60D21EEDAC742F81D0FF3C78634FF3
                                        Malicious:false
                                        Preview:<.d....!..`.......bgB.....X.A..+.......$.........Q.......R.......W.>...2.....-....1..+".C|....B.OY...%...]>...S..]>..!........j..........t...n.............-..|...%..W.... ..[C......p....-...#...*{...n..........)U.................zn...,..*......:....#..C....G.w\^.........%i......1y..TD......T....U...........N.....q3....<......&g...U...}...........T..............b........1...........R......$....... ........).c.......l.E.....l.E.....l.E..2...6.../\......#@...a..,^. ^>...o.....(.......'.......P............0p.#......K.s......s.........../...n............Z............@..\T.."..X5A.....q.C...j.x.........^.......N...c..L.......M...).................w. .....};....B......(........I..J..............?..........!..|....0...Q5......KT...|i..2s....@.$.0.9.;.>.2. .D.>.@.<.0.B. .R.A.W. .(.1.5.7. .7.0.3.;.0.2.:.0.)..........RAW (headerless) file format.....AudioContainerControl.....".$.0.9.;.>.2. .D.>.@.<.0.B. .W.A.V..........WAV file format.....AudioContainerControl.....2...C.4.8.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_ca.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):14877
                                        Entropy (8bit):4.495618627792468
                                        Encrypted:false
                                        SSDEEP:192:xWSMgD83O3Oesgu143Ik6f0w633EyAo3tb3Mb3y3CJ3Q3IF+P/F8NdEF3g033T3m:9M28+eesgY4npUyd9bsiSJP+Xu6Q03j2
                                        MD5:F4ACB5614C77260B4C1177CDB350942E
                                        SHA1:C53DA2DACF580A48D18E4BC36B513A6402147F4C
                                        SHA-256:99AAE58CE729312B4ED38DB7D8AA42C770EAA4CC3F669626F9BEB9676BC21EF2
                                        SHA-512:E736DD2B985F8E579598E9465C662E2D53427FC4ED05FFC1DD1580DBA485021581AD4D0700A58E971A48FF9D6455597BA486078DEDF72CEAB8B02E557FB9FA37
                                        Malicious:false
                                        Preview:<.d....!..`.......caB.....X.A../........7.Q.......Q.....2.R.....V.W.>.........1....1../..C|......OY...(..c....3...]>..!...]>..&y......................%...........t..2h.............,.......5..|...)..W....$..[C......p....1...#...._.......~...n...a..............-7.................zn......*.............:....'..C......w\^.. @.....)U......5...TD......T....Q......#J...N...g.q3............:......*]...U.."D...T..............b....[...1..................({......%U.........c.......l.E.....l.E...s.l.E..6...6...3l......'8..{4...}...a..0L. ^>.........,.......+.......`............4..#......K.s...I..s...".......47..n........2...Z..............=.......X5A.....q.C.....x.........^.......N......L....t..M...-...............Z.w. .. ..};...$.......+...........J.........../..?....g.....%..|....5`..Q5......KT...zi..6.....L.F.o.r.m.a.t. .d.e. .f.i.t.x.e.r. .R.A.W. .(.s.e.n.s.e. .c.a.p...a.l.e.r.a.)..........RAW (headerless) file format.....AudioContainerControl.....(.F.o.r.m.a.t. .d.e. .f.i

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_cs.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):15906
                                        Entropy (8bit):4.737087172418041
                                        Encrypted:false
                                        SSDEEP:384:RcPvbZYqjMvs1eEt86I3f4EwKiZU8UkFPU:RcPvbZYRvs1e76I3w+8UsPU
                                        MD5:3BBF388844D5DB68FBE5EF1ABF01031A
                                        SHA1:257CC6C095C67000D4DE8F832F3447E0F755905D
                                        SHA-256:6F116E7A2FDEFE84A890DF1718D235E61D5731BF7C2E3E57A838F6EC9EEDE0FA
                                        SHA-512:3F2328AADF5A8DFECE7DDED754CAA2C3FCC861564D135C6C1D0699AAA57A986E62B652EC41352EDC0353927A512F72844A124EAC3D8551AED794731B8B13C039
                                        Malicious:false
                                        Preview:<.d....!..`.......cs_CZB.....MJ....1.OY......X.A..6%................Q.....G.R.....s.W.>...i..D..........7...}q.......1..5..C|......OY...0Q..]>..(!..]>..-.......%.......T.Qz....m...t..8h............#...|...,@.W....+f.[C.......#...4...[E......'....t......:...n...L......3...........0$...Q..zn......*...&-..*...').:..../2.C......w\^..&......0...TD..#G..T...".......)....N...X..K....*......1....U..)!......(............T.."G....... ...1.......1.. ..6..................../.......+...........V......W......c.......l.E...,.l.E.....l.E..!...Z2.......~.......~......6...9E..........&A.......a..6....S...o. ^>...*.I}b.........3.......1.................... j..'.............#......K.s......s...)....N..........9...n........8..N........Z...............\T...-.X5A.....q.C.....x.........~...p...N......L.......M...4 .....$J.......5.w. ..'..};...*...o....h......2w..........J...._..J....J.......?.....$...?..........,...Q5..%...KT..!k..G.....i..:[....(.S.o.u.b.o.r.o.v... .f.o.r.m...t. .R.A.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_da.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):13659
                                        Entropy (8bit):4.616849544167846
                                        Encrypted:false
                                        SSDEEP:192:Xr0R2Psma1C9gNjFjOMFyp/vSR5p2h8klZBrNQ:XAR2PsmEFewyp/aR2ieZBe
                                        MD5:34BB0ECE3C0DB02ED3E1E73AE1932719
                                        SHA1:E23C7790CAFBA427A3E70F705B7B4CBE9F228DDF
                                        SHA-256:39D902411064CC5C5FD45742F1768022A1AE7953700741B2F608E3807E19110A
                                        SHA-512:9E1C462D2535D7262127AF3DF8028E27F57C3352E97EB28F6D4055516D453C9F60775283DD4A63EDD3ECB76C557F94F82988545B5016B764EE1DB8CA13AA87F0
                                        Malicious:false
                                        Preview:<.d....!..`.......daB... .X.A..+.......`.........Q.......Q.....p.R.......W.>.........- ...1..+L.C|......OY...%..c..../...]>...A..]>..#........t..........................t...\.....................'..|...&p.W...."..[C......p....-...#...*............n...I..............).......*..........zn...X..*...........T.:....$..C......w\^.........&.......1?..TD......T...._...... ....N...M.q3....l.......:......'....U.......T..............b........1...........<......%E......"..........c.....i.l.E.....l.E.....l.E..1...6.../,......$0..{4...W...a..,p. ^>.........).......'.......*............0V.#......K.s...#..s... `....../...n............Z..............=.....<.X5A.....q.C.....x.....{...^...{...N...'..L.......M...*...............<.w. .....};...!y......(|..........J....x.........?.........."..|....0...Q5......KT....i..2.....2.R...t. .(.h.o.v.e.d.l...s.t.). .f.i.l.f.o.r.m.a.t..........RAW (headerless) file format.....AudioContainerControl.......W.A.V.-.f.i.l.f.o.r.m.a.t..........WAV fi

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_de.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):15006
                                        Entropy (8bit):4.524251350180448
                                        Encrypted:false
                                        SSDEEP:192:szJCssbW1tE1I2oaaVCDKEeNByOApdLowK18C3B/:sz0ssbQt3IQBNSfK+gB/
                                        MD5:2EA100003233A563C03EC7B0A0C0D2ED
                                        SHA1:EF56DB962FC5217A0DAB92BCC6CABB1CBE825A00
                                        SHA-256:7D1541468BD09F4A34E78595DAEBDCFD7BF71715C34BF95C2DCCE41BF5484155
                                        SHA-512:799271B682DAC7C9DB10B8EB3BE5237355199A30013E08C92024C68A01806710971B0A812CBFDF023F21FD2A5298F1E3F4BFF9850D5D7E357BC12CA1F7164462
                                        Malicious:false
                                        Preview:<.d....!..`.......de_DEB.....X.A..0........7.Q.......Q.......R.......W.>...B.....1....1../..C|......OY...)..c....4...]>.."S..]>..').......Z..............Y.......i...t..3V........................|...*h.W....%..[C......p....2...#.../3.......L...n..................-...............E..zn...r..*... .........:....(r.C......w\^.. ......*.......6...TD......T....;......$....N...M.q3............@......+#...U..#"...T..............b........1...........L......))......%..........c.......l.E.....l.E...y.l.E..7...6...4<......'...{4.......a..1.. ^>.........-I......+.......B............5..#....g.K.s...g..s...#.......5...n...+....3...Z....+.........=.......X5A.....q.C.....x.....C...^.......N......L.......M...................T.w. ..!..};...$.......,...........J..............?..........&U.|....5...Q5......KT...di..7[....:.R.A.W.-.D.a.t.e.i.f.o.r.m.a.t. .(.o.h.n.e. .H.e.a.d.e.r.)..........RAW (headerless) file format.....AudioContainerControl.......W.A.V.-.D.a.t.e.i.f.o.r.m.a.t.........

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_en.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):16
                                        Entropy (8bit):4.0
                                        Encrypted:false
                                        SSDEEP:3:j2wZC4n:CwZ
                                        MD5:BCEBCF42735C6849BDECBB77451021DD
                                        SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                        SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                        SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                        Malicious:false
                                        Preview:<.d....!..`...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_es.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):17046
                                        Entropy (8bit):4.488067064247524
                                        Encrypted:false
                                        SSDEEP:192:qTAb/kqIRnp2Psn41kjT22m8T+dEw0Zpe4Q6fn87wZ9OdDq3D:MAb/kqIFUPsnKWhwcpeuf89da
                                        MD5:F2E05CF385B73830C66997878BBE96C1
                                        SHA1:1E5D672AB83BFB84ADE3C808F9A792F74FD1394B
                                        SHA-256:0866911BFD4C6E78D3517EA298DE653CAEF0B7248AEFACDBA5236E7565A9B2A5
                                        SHA-512:4C84CED507C284D7D50107F4086F30267F9057880F34320F54289F4E37761A4B7ABFA12A0BD6AD64E13ED0A7640E0B97555BE9B1D7B44B3C606CB0F581BBCA5A
                                        Malicious:false
                                        Preview:<.d....!..`.......es_ESB.....MJ....).OY......X.A..8@..............G.Q.......R.......W.>......D..........9...}q.......1..7..C|......OY...1...]>..)...]>...4......&.......Z.Qz....;...t..:.............$...|...2D.W....,..[C....).p....:5..#...7...[E..........P...n...C......5......"........u..0$......zn......*...'M.:....02.C......w\^..'......1.......=...TD..$Y..T...#.......+....N...g..K......q3... .......2....U..*!......)............T..#m.......H..b........1...!...1..!{.6....................0.......-...........V......W....Z.c.....w.l.E...F.l.E.....l.E..#..l.E..>....~.......~......6...;......./....a..8....S..... ^>.........5/......3.......w............ f.....<.........#......K.s...[..s...*....N..........<A..n..._....;/..Z....W..........\T.....X5A.....q.C.....x.........~...d...^...%...N......L....:..M...6c.....%H.......j.w. ..({.};...+...o....~......4...........J............W.....%...?....).....-~.|....=b..Q5..&...KT..".i..>.....J.f.o.r.m.a.t.o. .d.e. .a.r.c.h.i.v.o. .

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_fi.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):13883
                                        Entropy (8bit):4.587256778643159
                                        Encrypted:false
                                        SSDEEP:192:5xqudvG/srvG1YOIDcz0dIwMrOH5exEeTD5+oDwYKtToV8qxh+upeSIraT0wYnf6:/qudvG/srvAYO04xtTlrzKWeGgD6
                                        MD5:F9B40CF075E511A54ACF25CD301B2A05
                                        SHA1:C84D587DAC38A7E1747E420854978D1FC27A925E
                                        SHA-256:628BE72C1DC70652AB302E2F8CCB9F3C328E7FDDDF7D8D1C5CE21056A9BA84F2
                                        SHA-512:6D6C968D5A0F7FA46867A182261509C145522F8EC059AA4C42F28C4B38EF40A32CF2913F03BC800845B14BBE76AC6ED7F96E97C7BC4122C2B6D293D1E102D2BD
                                        Malicious:false
                                        Preview:<.d....!..`.......fiB... .X.A..,.......f.........Q.......Q.....V.R.....^.W.>...F.....-....1..,..C|......OY...&..c....0?..]>.. ...]>..$m.......L..............u...........t............................|...'n.W...."..[C......p.....W..#...+w...........n...W..............*m.................zn......*....o......t.:....%..C......w\^.........'.......2...TD......T....;......!....N...O.q3....t..............(....U.. ....T..............b........1...........6......&E......#_.........c.......l.E.....l.E.....l.E..2...6.../.......%(..{4.......a..-.. ^>...'.....).......(.......L............1..#......K.s......s...!>......0...n......../M..Z..............=.....t.X5A.....q.C.....x.........^...{...N...+..L....|..M...*...............,.w. ...U.};..."?......)t..........J..............?....w.....#..|....1...Q5......KT....i..2.....>.R.A.W.-.t.i.e.d.o.s.t.o.m.u.o.t.o. .(.t.u.n.n.u.k.s.e.t.o.n.)..........RAW (headerless) file format.....AudioContainerControl.....".W.A.V.-.t.i.e.d.o.s.t.o.m.u.o

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_fr.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):16502
                                        Entropy (8bit):4.523787100967048
                                        Encrypted:false
                                        SSDEEP:192:0zjDNrhYqqg7mPOnkq4wKAAEF8XDj7Ps7I1HzGetICvxbTV60PZtR2TeZm6Pynsm:07Nrhp3kCvsPs7am0bRPpEOOzB
                                        MD5:DF28B5BCDEDC3FDEAD3749E6A0861F81
                                        SHA1:7F64D46BD5D6BF7254242CF0DBDE179954123719
                                        SHA-256:622FB2AB66D224C946BBBE8B4B06CCB45EA4B1368BA0E822A07BAD4B7C4BBD36
                                        SHA-512:97D9053A6A236CA72D042597B4A150D703082810C1DE3542491938C93BFA871D2998A34C53F597913C80D5D02E0D7EF0E0CEB8D0609BB71B478E7E25A3317163
                                        Malicious:false
                                        Preview:<.d....!..`.......fr_FRB.....MJ....1.OY....'.X.A..6...............w.Q.....h.R.......W.>...0..D..........8...}q.......1..6T.C|......OY...0S..]>..(a..]>..-P......%d........Qz....E...t..:.............$...|...1..W....+..[C....c.p....8...#...5...[E...\..........n..........4...........0$......zn......*...&..:..../..C....#.w\^..'......0.......<'..TD..#...T...##......*S...N......K...........1....U..)e......)............T.."...........b........1.......1..!..6............. ....../.......,:.......'..V......W....\.c.......l.E...t.l.E...F.l.E.."U...~.......~......6...9............a..7|...S..... ^>...Q.....3.......2q......1............ ......;"........#......K.s......s...)....N...<......:>..n........9n..Z...............\T..-..X5A.....q.C...R.x.........~...b...^.......N.../..L.......M...5......$..........w. ..'..};...*...o...........3R.......-..J............W.....$...?..........,..|....;...Q5..%...KT..!.i..<.....H.F.o.r.m.a.t. .d.e. .f.i.c.h.i.e.r. .R.A.W. .(.s.a.n.s. .e.n.-.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_hu.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):16463
                                        Entropy (8bit):4.657374409195896
                                        Encrypted:false
                                        SSDEEP:384:RtGHxItMx2ssKAo0MZZPPXlDtAxb+tceVYwG9s4VbnzKMy9J:RtGHxItMx2ssKAo0MZZPPXlhkb+tceV3
                                        MD5:286A43C2C0699E792A63123EE3D11D89
                                        SHA1:2611BA80FBEF67CBE0C61CA981D5B37FD2841AEC
                                        SHA-256:589D857B96CB1C8E6DCB018C8CDAF71BF06D31AA1271867F8572183C9394F8D7
                                        SHA-512:92A7865CD3FF0CF2277100368193ABBF5557B4CF4323EF60DB998B1DA2317B9663E5199ADD6F6CA2F873942B5BAA40588253DE7F1335F0526380A00C63F4DA5F
                                        Malicious:false
                                        Preview:<.d....!..`.......hu_HUB.....MJ......OY......X.A..6D......Z.........Q.......R.......W.>......D....G.....7...}q...<...1..5..C|....N.OY.../...]>..'...]>..,.......$.......p.Qz........t..9.............#I..|...0f.W....+..[C....K.p....8W..#...4...[E..........p...n..........3......!@.......U..0$...Q..zn......*...%..:.....v.C....u.w\^..&>.....0.......;...TD.."...T..."u......)....N......K....J.q3...........1....U..(.......(V.......y...T..!........b..b........1.......1.. /.6..................../3......+........Y..V......W......c.....k.l.E...x.l.E...,.l.E..!..l.E..<K...~.......~......6...9............a..6....S..._. ^>.........39......1.....................*.....:.........#....?.K.s......s...)3...N...L......:K..n...5....9_..Z....1.......P..\T..-..X5A.....q.C.....x.........~...L...^...1...N......L.......M...4I.....#..........w. ..&..};...*V..o...........2........e..J............#.....$)..?..........+..|....;P..Q5..%...KT.. .i..<.....B.R.A.W. .(.f.e.j.l...c. .n...l.k...l.i.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_it.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):17194
                                        Entropy (8bit):4.475777186094896
                                        Encrypted:false
                                        SSDEEP:192:UC3TmO4QKfnqfbFgmLf6i5zmQjEPsT2i31ZG+f4YdzPXegWZQ3lQPmNEx4EzO31c:Uyrx0CaPsqkhjEeDUSBNs3h
                                        MD5:74E75500E4026F2DB8FF298B548E928A
                                        SHA1:085B10C64A4CF22444174805BCB6BA0AB5CCFC57
                                        SHA-256:ACA8D4DD145E671D827E582496F20281DC559AC91E7E13F88CF508BC2D6301ED
                                        SHA-512:6C20E99834D3033FC85FF23A9EFDD3D2DB4A40CDF24D69C04CA2470EEC4FF38469CDBE89DD62C4C620E9E3456D123F205A8A958E4FC717018BA832E9764BB2EF
                                        Malicious:false
                                        Preview:<.d....!..`.......it_ITB.....MJ....'.OY....U.X.A..8...... ........).Q.......R.......W.>...@..D..........:X..}q.......1..8T.C|......OY...2Q..]>..*3..]>../^......'0........Qz....I...t..;.............%...|...3$.W....-..[C......p....;...#...7...[E...j..........n..........6......#...........0$......zn...T..*...(c.:....1..C......w\^..(......2.......>o..TD..%e..T...$.......,=...N......K......q3...!.......3....U..+I......*............T..$w..........b....#...1.......1.."s.6.............P......1........,..........V......W....R.c.......l.E.....l.E.....l.E..$#.l.E..?....~.......~......6...<v......0....a..9....S..... ^>.........5.......4.......E............!d.....=n........#....O.K.s...Y..s...+....N...Z......<...n........;...Z...............\T..0..X5A.....q.C.....x.....5...~...R...^.......N...y..L.......M...7......&V.......>.w. ..)..};...,...o...........5Z..........J............U.....&...?.............|....=...Q5..'...KT..#.i..?g....J.F.o.r.m.a.t.o. .f.i.l.e. .R.A.W. .(.s.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_ja.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):14337
                                        Entropy (8bit):5.741374393238018
                                        Encrypted:false
                                        SSDEEP:384:zn1pQ8PxuF2WQMeOSJASTswQZs7WWdiTA6V8x:c8PxuF2WQMeOSJASTxQZs7WbTAWs
                                        MD5:27259833BCDE1CA4438A41863C9345DA
                                        SHA1:ECD2404A31215E2D814125D3DBD5ADC7C6D45083
                                        SHA-256:F9A888586C42C22894CCB4180257C2DE70299FF5D540087BC334DA74A8DD5969
                                        SHA-512:EA82A4CEB38CD6B134AB37A6257D88D6019D25B82D6B6E855A4ABA19A2403D18CBE9AA463CFB857EE221CA787EF47080336D9A1459F23F3582E5BD726A4BF84F
                                        Malicious:false
                                        Preview:<.d....!..`.......jaB.....MJ.... .OY......X.A....................Q.....q.R.......W.>...q..D....h...../...}q.......1..-..C|......OY...)D.l........]>..#4..]>..'....... .........M.......Qz........t..1......{..........|...)..W....%..[C......d.....9.p....0r..#...-J..[E..............n.......1..........,F..........0$......zn......*...!..:....(W.C......w\^.."+.....).......3:..TD...h..T...........$....N......K...........*V...U..#.......#........v...T...........S..v....7..b........1... ...1.......1...}.6.....[.H.C..................(.......&1..........V....c.W....W.c.......l.E.....l.E.....l.E.....l.E...\.l.E..3....~.......~...........~..6...1.......'....a../....S..... ^>.....5.t.........+.......*..............F......=......%.....2}........#....h.K.s......s...$`...N...!......2...n......w...}....1f..................Z...............\T..'..X5A.....q.C...a.x.........~.......^.......N......L....%..M...,...... /.......S.w. .."..};...%C..o....w......+i.......L..J................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_ko.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):11006
                                        Entropy (8bit):5.779927341401355
                                        Encrypted:false
                                        SSDEEP:192:rtqk8es6911OXRidgBnSQyHu5SW18acLhn:ps69rOHnzSW+acLB
                                        MD5:0161C0622AE59F0331FDE6C2D901327B
                                        SHA1:BC497F30FA42A5F73D2B4917FC2C12496EAFEE78
                                        SHA-256:F512A5E985535D0309F737E6156F5959AE9B6405E65FF76ABAE5A139332F2C7A
                                        SHA-512:903135B6C0D329F92B3617725749C64D1B24A28673BE325C471221C36378B01752AB57FB308CC6A69CA8D832C9BA1B472579320A55F48C3958093BE215B67107
                                        Malicious:false
                                        Preview:<.d....!..`.......koB.....X.A.."l.......q.Q.......Q.......R.....".W.>.........#....1..!..C|......OY......c....%...]>...o..]>...........&..............+.......k...t..$.........................|....2.W.......[C....[.p....$...#...!g.......(...n...C.......*...... .......P.......k..zn......*....+........:.......C....9.w\^...z.............'...TD......T....U...........N.....q3........................U.......T..........."..b...._...1...................5.................c.....=.l.E...\.l.E.....l.E..'...6...%X.......X..{4...m...a..".. ^>...U..... ........-...................&T.#......K.s...;..s....R......%...n........$...Z............P.=.......X5A.....q.C.....x.........^.......N...g..L....z..M... .......t.........w. .....};....'..................J....f.........?...........Y.|....&...Q5......KT....i..'..... .R.A.W.(..T. ....). ...|. ..............RAW (headerless) file format.....AudioContainerControl.......W.A.V. ...|. ..............WAV file format.....AudioContainerContro

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_pl.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):12237
                                        Entropy (8bit):4.698903308278698
                                        Encrypted:false
                                        SSDEEP:192:ej9dNDgWPsRh14pT260/C5nwL8CCQhoTBsyX2+N8dfu3:e5fDgWPsRXGq6sC5wYCCQ3z+Gf8
                                        MD5:2F3EA58057D8F5EE06B505B41079C981
                                        SHA1:13D38D2B95CC473A5C5CD1D6A3BD9FF69B5351B3
                                        SHA-256:3C4CB711F6A59E5B19E4ADC0D0A6BE63C0BB55F15626AD640DB1BFD1D1363664
                                        SHA-512:B8D5BE73F0291B4A63603541A0174C9E59E9C3C7A5560471B28FEC08B65D1ADFFBE4D52516D3A611E4B81941199103A4367B7A936198F12F2AEDC4245C810A08
                                        Malicious:false
                                        Preview:<.d....!..`.......pl_PLB.....X.A..&I......6.........Q.......R.....6.W.>.........'....1..%..C|....J.OY......c....*0..]>...W..]>...........f..........t..(.................|... {.W.....Y.[C......p....(J..#...%.......#..................zn......*......C....c.w\^......... ......,...TD......T....7...........N.....q3....L......!....U.......T..............b........1...........H.......<...............[.c.......l.E.....l.E..._.l.E..,...6...)............a..&.. ^>.........#^......!.......T............+-.#....i.K.s......s...........*...n..._....)N.X5A.....q.C.....x.........^......L....X..M...$`................w. .....};..........."...........J..............?....]......=.|....+...Q5......KT...ti..,.....@.F.o.r.m.a.t. .p.l.i.k.u. .R.A.W. .(.b.r.a.k. .n.a.g.B...w.k.a.)..........RAW (headerless) file format.....AudioContainerControl..... .F.o.r.m.a.t. .p.l.i.k.u. .W.A.V..........WAV file format.....AudioContainerControl.....8.D.a.n.e. .d.z.w.i...k.o.w.e. .w. .p.o.s.t.a.c.i. .P.C.M

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_ru.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):14109
                                        Entropy (8bit):5.264248799271436
                                        Encrypted:false
                                        SSDEEP:192:QKqItPsF4e6V1gHrptgfwwstDEp6SdZ9ZAUfiYNFzF0XJyo9Ea56V8C7Q7+ESqbj:QKZPsKZgt8dwYWXfEatierSqzb
                                        MD5:1841A70C30F9A2F3AA3F5BAEFF9208EE
                                        SHA1:3C9594CF1F3E2E64A74C32094F3B9A032C7E7FB1
                                        SHA-256:32C1118415F25A378D356CF01652393C8F9063145BC8F8A93C4F992166FA9D4D
                                        SHA-512:1C6A6A2775109FA28717913E35370CDCA5BD60C229CFD5BD63066044964EB165D65634B32E5BC6BBC4D6CBFACDB9C35B5192295CFDB85A88A9FC0A6E71704CD2
                                        Malicious:false
                                        Preview:<.d....!..`.......ru_RUB.....X.A..-..........Q.......Q.......R.......W.>..........b...1..,|.C|....>.OY...&..c....1...]>......]>..$M......................#...........t../.........................|...'N.W...."..[C......p..../...#...+............n..................*...............{..zn......*...........@.:....%n.C......w\^...b.....&.......2...TD...;..T...........!P...N.....q3............<......'....U.. P...T...i..........b........1..._.......6......&.......#........g.c.......l.E.....l.E.....l.E..3w..6...0.......$...{4.......a..-.. ^>.........*.......(.......J......j.....1..#....O.K.s......s... .......1[..n...U....0...Z....C.......P.=.......X5A.....q.C.....x.........^...e...N......L....:..M...+=................w. .....};...!.......)p.......k..J...........s..?....5.....#..|....2`..Q5...A..KT....i..3.....@.$.>.@.<.0.B. .D.0.9.;.0. .R.A.W. .(.1.5.7. .7.0.3.>.;.>.2.:.0.)..........RAW (headerless) file format.....AudioContainerControl..... .$.>.@.<.0.B. .D.0.9.;.0. .W.A.V.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_sk.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):9896
                                        Entropy (8bit):4.651417016192566
                                        Encrypted:false
                                        SSDEEP:192:ymzlPsi1CPNRUNEjHE4YdKNoKBrbd8vFPe:1Psc6gEjHE4YdaNBH2vFPe
                                        MD5:D9B73E1E553693BBE20729B972166E70
                                        SHA1:6FBE8ACAF2671791C9043508D4FC6D8E5B804C7B
                                        SHA-256:82F544F31FFB0CE80340F445AD2C8E2BA57969413EF9B5D10FE4322BB96A6851
                                        SHA-512:BA376AE10C71C9770D60B6E3D177F5FE26C7A496B53E4F50686B6B538B71CB7D397B01012C334C26C85B2A62B436E7600B4CE847AF7D93F1514101DD9EF6175C
                                        Malicious:false
                                        Preview:<.d....!..`.......sk_SKB...8.X.A.. q.].....N.....!....1.....OY.......]>...3..]>.....................+........t.."Z...A.......=......|....>..|......W........#....<..'............0..........*....5..*....=.:.......QM^.....w\^..........#.......'.......~...U...-.......i...............................Q.......0.........l.E...n..6...#?..........&A......b...D...a..!.. ^>......tQ.................. .........'....Z.#....h..s...........#...a...h.........nE........"..N.....$..Z....}..\T......y.......L....y..M..............w. .....};...............J....Y..?....y......4.nP9......Q5......G.....i..$A....".R.A.W. .f.o.r.m...t. .s...b.o.r.u..........RAW file format.....AudioCaptureSession.....".W.A.V. .f.o.r.m...t. .s...b.o.r.u..........WAV file format.....AudioCaptureSession.......P.C.M. .a.u.d.i.o. .d...t.a..........PCM audio data.....AudioEncoderControl.....0.K.a.m.e.r.a. .n.i.e. .j.e. .p.r.i.p.r.a.v.e.n............Camera not ready.....CameraBinImageCapture.......J.P.E.G. .o.b.r...z.o.k.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_tr.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):13295
                                        Entropy (8bit):4.762391970296969
                                        Encrypted:false
                                        SSDEEP:384:05P7BsqxeP7OZaiOkP+HxW6gt5wQha7JVjSprkcJmcM8:AP7BsqxK7OZ9ORHQdt5XhAJVjSprtJmY
                                        MD5:E7E3EA251F76ED3C680CE40CB2C62250
                                        SHA1:92625294D74741F479D28C2C3110DCF0C815DB2F
                                        SHA-256:1C79A82DCD0314EBEC350293FFFE9E2CD35CCC6BD63C449C178D42EF1DA375CF
                                        SHA-512:F7997F9424C65CC9F880D211919E06157073B9083BA54435BF7BAF2AD806104DEA4E985EB055998DFECD73D00613E42F1C62C799AA4BA505A0BDDF36C3AC8594
                                        Malicious:false
                                        Preview:<.d....!..`.......tr_TRB.....X.A..**.......C.Q.....f.Q.......R.....0.W.>...n.....+....1..)..C|......OY...$..c........]>......]>..!...................................t..,..............h..........|...$..W.... s.[C......p....,1..#...(............n...........|......'..................zn......*....%........:....#..C......w\^.........$g....../...TD...C..T............8...N.....q3....8..............%Y...U...X...T...c..........b........1...........B......#....... ..........c.......l.E.....l.E.....l.E..0g..6...-......."...{4.......a..*.. ^>.........'A......&.......F............/..#......K.s...Q..s............m..n...C....-7..Z....!.........=.......X5A.....q.C.....x.........^...g...N......L....|..M...(;......&.......r.w. ...#.};...........&........-..J....~.........?..........!I.|..../l..Q5...m..KT...@i..0.....8.R.A.W. .(.b.a._.l.1.k.s.1.z.). .d.o.s.y.a. .b.i...i.m.i..........RAW (headerless) file format.....AudioContainerControl..... .W.A.V. .d.o.s.y.a. .b.i...i.m.i.........

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_uk.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):15781
                                        Entropy (8bit):5.306567482773278
                                        Encrypted:false
                                        SSDEEP:384:1RamDXePsF0HwX1Rsd6ml+0HHCiwMmcrSWo2:XamDXePsF0HwXfsYm+0HHCiwM5SWo2
                                        MD5:1E8E91CAD32A6610D54E838C803E93C7
                                        SHA1:073965FDDD20601A8348B548DDB174B832D735B1
                                        SHA-256:EBF67318490F70C765B50B6CC4EB3CD4C0EAB9FF10A19BC44A0489B24CECD834
                                        SHA-512:29C1F790613F0B2D41685F0F6A6B910F66BD61C035F8A5B3CF4B18A7C92E4D221B1DC6C27DE67803E8FE654DE3B3BCEB2746F5B510D9CB79AC1BC943D1D73B38
                                        Malicious:false
                                        Preview:<.d....!..`.......uk_UAB.....MJ......OY......X.A..3.......j.........Q.....8.R.....p.W.>......D....C.....5 ..}q...4...1..3|.C|....V.OY...-...]>..&3..]>..*.......#t......v.Qz........t..6<............"-..|......W....)`.[C....;.p....5...#...2...[E..........v...n..........1...... ...........0$...S..zn...&..*...$..:....,..C....u.w\^..%.......7......8...TD..!...T...!Y......(....N......K....8.q3....p....../+...U..'3......&........s...T.. ...........b....{...1.......1.....6....................-a......)........]..V......W......c.....'.l.E...l.l.E...$.l.E.. ..l.E..9....~.......~......6...7.......,6...a..4....S...c. ^>.........1E....../...........................8.........#....}.K.s......s...'....N...D......7w..n........6...Z....u.......t..\T..+..X5A.....q.C...~.x.....9...~...H...^.......N......L.......M...2i....."..........w. ..%..};...(...o...........0...........J..................#...?..........*F.|....8z..Q5..#...KT....i..9.....@.$.0.9.;. .D.>.@.<.0.B.C. .R.A.W. .(.1.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\Qt5\translations\qtmultimedia_zh_TW.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):9951
                                        Entropy (8bit):5.774304533562878
                                        Encrypted:false
                                        SSDEEP:96:2RHL3+0SNWeYxupp/mptZFp4tiUIHuewNSrNSh5NBBVJV69tDxTZBm59bN/5yQKq:IrkrYsEt14q8YrYLBbJVGDL4xK8NfYI
                                        MD5:0017FC26EB26E431C09349A310AD6208
                                        SHA1:C37FC24AED1827F81D2B2B8C673DC9BDD5CE7676
                                        SHA-256:981492BD3B7A83B280F7DE296BE80D55FC3150A45358F93745E4BE3DDEEC5CB7
                                        SHA-512:55896D19DA1CDDE36201D9B0EE268298CE63CB1F7145762E66E426EACCDAC5F8333FD617986697937EC5F000274BF2F066F38E3CEE879649D35E75CFCC92F034
                                        Malicious:false
                                        Preview:<.d....!..`.......zh_TWB... .X.A..........v.........Q.......Q.....>.R.......W.>..............1...T.C|......OY....y.c....!...]>......]>..........................O...........t.. .........................|......W.......[C....5.p.... K..#................n...7.......r..............<..........zn...z..*.............:.......C......w\^...&............."...TD......T..../...........N.....q3....................s...U...r...T..............b........1...................#.......9.......m.c.....9.l.E...D.l.E.....l.E..#U..6...!p.......b..{4.......a...<. ^>...s.................................."R.#......K.s......s...........!...n...{....!...Z..............=.......X5A.....q.C...F.x.........^...i...N......L....2..M....]......D.......p.w. .....};....y.......^..........J....b.........?.............|...."...Q5...[..KT....i..#.......R.A.W. .(q!j..-.). j.hHh<_...........RAW (headerless) file format.....AudioContainerControl.......W.A.V. j.hHh<_...........WAV file format.....AudioContainerC

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtCore.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):1982976
                                        Entropy (8bit):6.605444090115069
                                        Encrypted:false
                                        SSDEEP:24576:iDQwlm099ovDcJ/8Hf1YrZ8exoXpqD1WfK7MBEuaRgnmoD8z4SqUDOsWsJ5/wiGH:iDlmEXwK7MBznZDGj8em
                                        MD5:21609415D185489378FDC43809BFD071
                                        SHA1:C42FEF56FD2CE70CD1FAA64E5662874D2029AAB3
                                        SHA-256:D120FCCEC49797A904595EB739781DE4A5976080D4F6E8BFCA455F186813BB6E
                                        SHA-512:3B1CF23F3BB25E49D12B30468DFDFAC752892FAF26F43F948CF5DFB8EB45ADFAEF62B72B2D6D39EEE807D63D306A8DA72709A5A2654E51A046D50744CE6B2E34
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.B*..,y..,y..,y..y..,yF.-x..,yO.-x..,yF.)x..,yF.(x..,yF./x..,y..-x..,y..-x..,y..-y.,y..)x6.,y..,x..,y...x..,yRich..,y........................PE..L....i%e...........!................i........................................p............@......................... ...L...l.......................................|[.......................\.......[..@...............t7...........................text.............................. ..`.rdata..............................@..@.data........P.......4..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtGui.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):2022400
                                        Entropy (8bit):6.666787807656882
                                        Encrypted:false
                                        SSDEEP:24576:yxkbwbo6E2S2IQ9Vx83ZLj2EC/GYK8Wfyx61ZWe18hG:prpxi61T6
                                        MD5:F72EB5F6A046D9AA50AB0A41C88CC09B
                                        SHA1:7285E4575CA6742430F76AB383B32D3FA0539C1D
                                        SHA-256:9E8655831F3C3332D451D93AE059DA9AE704B222ACBE6455A7890D25CABAECC5
                                        SHA-512:7698825724904BB8C78969F509D87D1BF66147BFA3C5E3F8916170D1FD4735A7D02EA10EB2A658BB7B9D6C8C1C105ECA284A2472E57A78BA265A7D587CEF8991
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.................5.....B.......K.......B.......B.......B..........................].......................Rich............................PE..L... j%e...........!.........6.............................................. ............@.............................L........................................o...i...............................i..@...............4=...........................text...=........................... ..`.rdata..............................@..@.data...,...........................@....reloc...o.......p...l..............@..B................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtMultimedia.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):736768
                                        Entropy (8bit):6.518668790566688
                                        Encrypted:false
                                        SSDEEP:6144:SUjLOR+AfmVh9Rv8DvgUGtuqPYldhiYXtFwMRBJV57ukR27rifYyu2gQX9//TreF:qR+AuRXl3YdtBjKpGH41P1T
                                        MD5:18C5FF0698F514AC2F3063CFE9D86324
                                        SHA1:A577F195E3BA007CB012EB51CD4FAAAB8141B041
                                        SHA-256:F2A0323F856E90EE55BCFA7A965AE030F0CEA0B28CFDBA200660CF5D38DC116D
                                        SHA-512:926655B1F3061274928293A406CBAF39240B3105ADFA4C63758DECC759A16A324FBF157C30D384A7929808054F6B73AD3103A6C1AC9F063BD7C8562D42D7F6C8
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.r...!...!...!.g.!...!.j. ...!.w. ...!.j. ...!.j. ...!.j. ...!.b. ...!To. ...!...!...!.j. ...!.j. ...!.j. ...!Rich...!................PE..L....j%e...........!.....T...........W.......p...............................p............@......................... ^..X...x^...............................p.......2...............................2..@............p..0............................text..."R.......T.................. ..`.rdata.......p.......X..............@..@.data........p.......N..............@....reloc.......p.......>..............@..B........................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtNetwork.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):566784
                                        Entropy (8bit):6.558511749339486
                                        Encrypted:false
                                        SSDEEP:12288:N/EhG5Fp+mXwSZMB6jlniiuZOBWqVBbEs0HlfqbnV:NshwXMB6jlnyNqb
                                        MD5:A766FC404DDB88C55F4EA8D8073BF2C0
                                        SHA1:46501B3770393C7BCFB2840D491B52E217D03233
                                        SHA-256:B6F3AEB8E0297F25EC37CD66B8600473631140B4BFD60D1C3119B172F89DFD68
                                        SHA-512:451B6FCA2A56D7B53D3E15D96223ED8AEDC5C9A096B10B4FF9BC8F9D11C9D26F31E99564723A9CA8073B97647692EA45EFE2414EFFC7B659C1E72B9AAE7721BC
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... }!.d.O.d.O.d.O.md.`.O.6iN.f.O.?tN.f.O.6iJ.w.O.6iK.n.O.6iL.e.O..aN.f.O..lN.a.O.d.N...O..iJ.f.O..iO.e.O..iM.e.O.Richd.O.................PE..L....j%e...........!......................................................................@..........................c..T...$d..................................@....P...............................P..@...............|............................text...2........................... ..`.rdata...m.......n..................@..@.data.......`.......L..............@....reloc..@...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtPrintSupport.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):200704
                                        Entropy (8bit):6.451056735860483
                                        Encrypted:false
                                        SSDEEP:6144:4Uo3QTpDjqhgaxbZBgId8Bdq5+OZsMwVadqk0Jxk:Ho3H8Kik
                                        MD5:760EC3E14BAE77160CE97DB6149C4894
                                        SHA1:66264513E4BBE59D0D03F7C177E5B8CE7707A9AE
                                        SHA-256:8209FF8EA4C864E2FCD1FA90B6635D619FD3B67F2022DD4F30A487AE25DBE0FD
                                        SHA-512:7E1200A07E86DEEE3602C1A598E1E78821AA931E9EC3FA60123589E1088BABD4813CFCB2672B10CD41F382D5D13208A60B11A4673E1CB1B88A3B160EA05E8A6B
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B.....................................................T..............................Rich...........PE..L....j%e...........!.........>...............................................P............@.........................Pr..\....r...................................C..4e..............................Pe..@............................................text............................... ..`.rdata..~...........................@..@.data...04.......2..................@....reloc...C.......D..................@..B................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\QtWidgets.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):4016128
                                        Entropy (8bit):6.554254317806606
                                        Encrypted:false
                                        SSDEEP:24576:o/OciWYCGBjmGJpHzrZr9MV7vNPDmAg0gT5ITHFfvwsbxs8BN6OPeHSBNM0c4E1/:yAhrZA7VNv1c4EZL
                                        MD5:7DF4352378289E01C7F83D68FEC6BABC
                                        SHA1:A5733C04CC0198420386ED2EA75795AEF59B9257
                                        SHA-256:F81DBD368384F1D0DBA677EB6BE12206D2A31F6DA120ABD8BEDB6BFF612DE6B9
                                        SHA-512:8871A008FB43BF154F599F4CBE435609EFFD8A5CE6D2B6271C51F22E5E1C297915FBDF217AA5950AF60D53D1E83FB18DD27451C2C8612841092D802D35E5C2AA
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................:..............................................Z.................................Rich...................PE..L...Aj%e...........!......$...........$.......$...............................=...........@.........................../.T...d./...............................7.h......................................@.............$..\...........................text.....$.......$................. ..`.rdata..`[....$..\....$.............@..@.data...0.....4.......3.............@....reloc..h.....7.......7.............@..B........................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\PyQt5\sip.cp310-win32.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):94720
                                        Entropy (8bit):6.461428241926437
                                        Encrypted:false
                                        SSDEEP:1536:cSkWOqWw+FD4BXybYeosVmUBOSMZraWl/HzJOLFgGPizWrcfUPrhNLsOsmRyLMsz:sWOHDFEdBRStWFTJO1ayIinRyMss3Yol
                                        MD5:52B89F57276FF69B6F5EAFB1E23E372F
                                        SHA1:E24FC90391A33228674CA5D3E23C466F78C49B8B
                                        SHA-256:DAFED1ADDD8A8195B1F7FB4A5A46F89900025A0FCD46932520F7AEB20A354BF4
                                        SHA-512:DA79EDCB64DAD0550EF676369B59E606C7B763D306EC431D77A43AD5CC5AE605704BAEE5E3B210FB6CBD00C28B4EDA1704DCF973FCC04E04601BA0A04BFB0417
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..wQP.wQP.wQP...P.wQP..PQ.wQP..PQ.wQP..TQ.wQP..UQ.wQP..RQ.wQPJ.PQ.wQP.wPPEwQP>.YQ.wQP>.QQ.wQP>..P.wQP>.SQ.wQPRich.wQP........PE..L...>.#e...........!.........d............... ............................................@..........................D..T...TD.......................................?...............................@..@............ ...............................text...~........................... ..`.rdata...6... ...8..................@..@.data........`.......J..............@....rsrc................X..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\VCRUNTIME140.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):76168
                                        Entropy (8bit):6.765544990184352
                                        Encrypted:false
                                        SSDEEP:1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN
                                        MD5:1A84957B6E681FCA057160CD04E26B27
                                        SHA1:8D7E4C98D1EC858DB26A3540BAAAA9BBF96B5BFE
                                        SHA-256:9FAEAA45E8CC986AF56F28350B38238B03C01C355E9564B849604B8D690919C5
                                        SHA-512:5F54C9E87F2510C56F3CF2CEEB5B5AD7711ABD9F85A1FF84E74DD82D15181505E7E5428EAE6FF823F1190964EB0A82A569273A4562EC4131CECFA00A9D0D02AA
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................{.........i.............................................................Rich....................PE..L...>|.a.........."!.........................................................@......{.....@A......................................... ...................#...0.......#..8............................#..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_asyncio.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):56600
                                        Entropy (8bit):6.701238830377098
                                        Encrypted:false
                                        SSDEEP:1536:FDUfUUn5KdYveu2H7sz9YHIRTRILOnY7SyOPx3A:FDgDn0KPz9YHIxRILOnYIx3A
                                        MD5:252C9B6FCC220FE16499ABF4A8E2A2E8
                                        SHA1:03327874A1153E9FE640E6F5E8D987CCC84034C4
                                        SHA-256:E01FDB89380EBF58700F40DCEBAFCB37F24970C8EA1F33063BDEA873B53E720D
                                        SHA-512:F68C9D043D5EF7A32098DDD9C1622F761F88DA31CA47450AB1D95E51AB8CD06E1658DC57DB150AAF51B682F7F285654E6BBD118B3CA8400BB5B2D461BDC78926
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...T..T..T....T...U..T...Q..T...P..T...W..T.m.U..T..U..T..U.+.T.m.\..T.m.T..T.m....T.m.V..T.Rich..T.........................PE..L...9.,d...........!.....R...\.......V.......p......................................B.....@.............................P......d......................../..........(...T...............................@............p...............................text...TP.......R.................. ..`.rdata...7...p...8...V..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_bz2.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):72472
                                        Entropy (8bit):6.8432832170573255
                                        Encrypted:false
                                        SSDEEP:1536:QxDhX4Vb2zMIsTRGxT+0q8i9qK5ILCVwQ7Sy8Pxer:mhi2zvsCK0ti9qK5ILCVwQ6xw
                                        MD5:5C952E57426E429F6F4CEC9FEB841815
                                        SHA1:83BFD2108E188909C7FF3B294AB9C99336D02D06
                                        SHA-256:B682E9E8152036BDEBF4CA5410D3C0F88FA3272A969830F63C7B61BB1F0DA89F
                                        SHA-512:2B6AB5F24E7E232C8906AC12C5A4994CFCF1B061FFC25407F278DE3D97664716C24E58237EE6EC48949AC6C1F4522AA1CA4C5238015D128E3A9BE602D2CE0ED2
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.:...i...i...i.svi...i.~.h...i.d.i...i.~.h...i.~.h...i.~.h...i.~.h...i.s.h...i...i...i.~.h...i.~.h...i.~.i...i.~.h...iRich...i........PE..L...Y.,d...........!.........D.............................................. ......!.....@.............................H................................/.......... ...T...........................x...@...............8............................text............................... ..`.rdata...-..........................@..@.data...8...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_cffi_backend.cp310-win32.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):155648
                                        Entropy (8bit):6.63555006600095
                                        Encrypted:false
                                        SSDEEP:3072:VeqZA3oBbzbl0uLOEshrI/hTR6wlu556DXbU7xxyTL3qyAUHPN0s:4oA3RuLpshrQlu55uXbmxyTL6yDHPK
                                        MD5:84E1F73A3E4E6D4B6AFD8D9EF10B1924
                                        SHA1:5BD989147215F91D0FD2A17C23D02BBF9FAC89BF
                                        SHA-256:FF874A41DC5D656BC24E48D5193345C09281EBFB7EF7724EF760FC9B1FF37439
                                        SHA-512:57C66BB7AF04512BDE04AA82F75087D2B7F5A82B67B59E860DAA4A660E046891CBE62309B05305D725F71C30DEBFD2829068485164BC46F106355DD79BF5CDCF
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#...p...p...p..Bp...p..q...p..,p...p..q...p..q...p..q...p..q...p[..q...p...po..pW..q...pW..q...pW..p...pW..q...pRich...p................PE..L...<..e...........!................-.....................................................@......................... %..h....%.......p........................... ...!.............................. !..@............................................text...M........................... ..`.rdata..4...........................@..@.data..../...@.......$..............@....rsrc........p.......<..............@..@.reloc... ......."...>..............@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_ctypes.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):108312
                                        Entropy (8bit):6.644234290397436
                                        Encrypted:false
                                        SSDEEP:3072:qS6mSAe9tVW/dhyGfnH/Jt5Phld/7VILLPf17Mxk:qS6mzInWlhyiH/Jt1d/7wJ
                                        MD5:FF0992DFB0D4D90BDCEAAD68246C5C22
                                        SHA1:3508B7D730DDE3DB94AE413625451AE8CAA0BD7D
                                        SHA-256:F879F86BF65CE05EE3467DF65C55B9837F9DFFB0F024C350C9A9869A08609759
                                        SHA-512:8BEBC01958D71B327CBC39ED04BC53F6484CAA0232A1FD71E6691BDAA89FCBC766BC888D45870DC24D1190C48A0AE0A58C447EC936E34DB23059EE6F35A138BB
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................H..............................................Y........&................$..........Rich...........................PE..L...W.,d...........!................................................................)]....@.........................P4.......4.......p...............x.../.........../..T............................/..@............................................text...!........................... ..`.rdata..TK.......L..................@..@.data...l....P.......:..............@....rsrc........p.......V..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_decimal.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):195864
                                        Entropy (8bit):6.894532348319941
                                        Encrypted:false
                                        SSDEEP:3072:HJwcAu1LgDNsFyrbz5arkp1Lq00rBCXN4hmuqaxgU3pJMWlXgWcW+33SgRILOqXv:HNAg8rRaULECXN4Quqax33XMW5gJW+34
                                        MD5:FBE8BB3048DF17FF9DDB0972825FDA71
                                        SHA1:E3AD65446B60554CB9F7C45700BE2EAD1453772F
                                        SHA-256:283AA604D532B6239AA8D8794C8D8A4F3A11C93DFBCEF846315CFD74F5E07E2F
                                        SHA-512:48C66F10F9E79359DF63FD381C21B4559438DAE7AD84C625EFE1C7AB802F31BB8D326650F654C8EA504791595D801679A6F156F7ED90DA98AEBC04D2120C90A6
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m<.c)].0)].0)].0 %"0'].0{(.1+].0{(.1%].0{(.1#].0{(.1-].0.(.1*].0b%.1+].0)].0.].0.(.1&].0.(.1(].0.(N0(].0.(.1(].0Rich)].0................PE..L...E.,d...........!................(........ ......................................R.....@.............................P...`............................/......t.......T...............................@............ ..d............................text............................... ..`.rdata....... ......................@..@.data...x...........................@....rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_hashlib.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):49432
                                        Entropy (8bit):6.749500211425154
                                        Encrypted:false
                                        SSDEEP:768:H+OYENKnr4deUNXT1Ee20RILOIS5YiSyvWPxWEa1E:HbYENsr4MWT1Ee20RILOIQ7SyOPxl
                                        MD5:2AC2DEE9FDB32BE30FEFD4FDB5D280B3
                                        SHA1:5E803C5D649521CAB34BFC7EF6DC44954915220D
                                        SHA-256:F10C90062EAA68F41B1A6B34F3796E3AB8E0D765E595236E893CFF9FAD30116A
                                        SHA-512:86A7DFE6F15FCE67ACCBC84262C73D25F2E440B7529143235B9B32F15F7804F99206E24C5ED8E5219BB5895BF6E397304BA153E064FF97EED23F5E92469E901E
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.&...H...H...H.......H._.I...H._.M...H._.L...H._.K...H...I...H.F.I...H...I...H...I.H...@...H...H...H......H...J...H.Rich..H.........PE..L...q.,d...........!.....>...T.......C.......P.......................................+....@..........................w..P....w.........................../..........(s..T............................s..@............P...............................text...t=.......>.................. ..`.rdata..j4...P...6...B..............@..@.data...h............x..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_lzma.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):148248
                                        Entropy (8bit):7.03034519275223
                                        Encrypted:false
                                        SSDEEP:3072:VcSEmJbTMWUCFHRQWtwjEYZLlFrFvIB+hBJQ8T374Tu2d//zHf39mNoBJNWQ5ILt:GwUC9RQWtwjEGgYXT3CTvYOVWQI
                                        MD5:6174470C775AD7529891E1BA3C54F87B
                                        SHA1:A1536BDECFD42F99BD1CC561EC727D81F613D205
                                        SHA-256:E1E346F8B9FA43EC5519166D92625168EBB642A70F52611545117631C74181BD
                                        SHA-512:0595EA1C8D2784D1C8272E29D8E9C1C074FFA1CA14116AE7E65C52DA1D1E87A0AE1FD9D3EF285F887A8847008DA1EBE3E1F6ACF1294AFDC9E2F31216F7AB7CB4
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*.P.D.P.D.P.D.Y...T.D...E.R.D...A.[.D...@.Z.D...G.S.D...E.S.D...E.R.D.P.E.1.D...L.j.D...D.Q.D.....Q.D...F.Q.D.RichP.D.........PE..L.....,d...........!.....f..........<k.......................................@.......C....@.............................L.......x.... .................../...0..t.......T...........................H...@...............x............................text...[e.......f.................. ..`.rdata..b............j..............@..@.data...H...........................@....rsrc........ ......................@..@.reloc..t....0......................@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_multiprocessing.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):29976
                                        Entropy (8bit):6.798507676792536
                                        Encrypted:false
                                        SSDEEP:384:aQJATEdgw8HYcj4HjzjuRTBax6i+5/ZMILWBLCHQIYiSy1pCQHcPxh8E9VF0NyUC:9kHYDs88HFZMILWtY5YiSyv8PxWEaC
                                        MD5:7AB685D3F467C7029DEE1A943BB19065
                                        SHA1:BCADE206E6863874EAF72A1CAA748FBDEE916970
                                        SHA-256:91889BBF6DFADFC026276141A4260D7F2C19090FDE9EE04490B9211DD3933EBA
                                        SHA-512:D8E8CABA0D030FA0433D71D376608ACA2DA003D76C67FE9AB8C7B7E4A6AA7E0C21454E1D45CD052BB67B681B57094BDFA9CD634C1A1AE22C104568D20D13B02A
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ Nb.A 1.A 1.A 1.9.1.A 1.4!0.A 1.4%0.A 1.4$0.A 1.4#0.A 1i4!0.A 1.A!1.A 1.9!0.A 1i4(0.A 1i4 0.A 1i4.1.A 1i4"0.A 1Rich.A 1........PE..L...D.,d...........!.........,...............0......................................./....@.........................P<..`....<..x....`...............F.../...p.......7..T............................8..@............0..H............................text...t........................... ..`.rdata.......0......................@..@.data...`....P.......4..............@....rsrc........`.......8..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_overlapped.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):42264
                                        Entropy (8bit):6.794037552069512
                                        Encrypted:false
                                        SSDEEP:768:Hv9eDBCwgCnLEggqKboqjzezQPxNILXtV05YiSyvdPxWEaoC:FwgULj8NvezQPxNILXtVe7SylPxRC
                                        MD5:0A4AAABED72E8E08143EB129E5E24407
                                        SHA1:A85094E29FE1DE755DFB2BB2650378CA7BD1F5F2
                                        SHA-256:2233C561A18D92ADC2F4C56D6C55ADFB4A01049E801BDD3BB2A03CEE125F6E43
                                        SHA-512:79942D76D23376C71028EED8658E2C938DFE64D54D56FC60C0CA8F2FCA9515D7A5A24A5ABFDCB51DFF944ED2F7BEB17B6D5BA50D45A62DE9A7DB4FDCF6A04F62
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P..f...f...f......f...g...f...c...f...b...f...e...f...g...f...g...f...g...f...b...f...n...f...f...f.......f...d...f.Rich..f.................PE..L...H.,d...........!.....8...>......]<.......P......................................{.....@..........................h..X...(i.......................v.../......$...8d..T............................d..@............P...............................text...$6.......8.................. ..`.rdata...#...P...$...<..............@..@.data................`..............@....rsrc................d..............@..@.reloc..$............n..............@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_queue.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):28440
                                        Entropy (8bit):6.828727954203399
                                        Encrypted:false
                                        SSDEEP:768:gtbUDut6rf1vYvVILQUG5YiSyvhPxWEa4:uUa8f1vYvVILQU87SyJPxp
                                        MD5:2E6FE907E37F3F9154DB187C1B7F8232
                                        SHA1:77F25B5D95097DFDA0F9FD58632F8711091547CD
                                        SHA-256:763D333C80F4C11861C9210C4BD53FEDA24B5598AC9270391B2EC250BD52B636
                                        SHA-512:D87683A681D576CB334BDF2CE385E6BDB115D18232E160F17535A6BA432342604ADE6404F085F64ECA63C639860968603D4D8DB11A11520A1BC44B2A57FE00AF
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p..p..p....p...q..p...u..p...t..p...s..p.m.q..p..q..p..q...p.m.x..p.m.p..p.m....p.m.r..p.Rich..p.................PE..L...H.,d...........!.........*...............0............................................@..........................<..L....=..d....`...............@.../...p..\...`8..T............................8..@............0...............................text............................... ..`.rdata.......0......................@..@.data...@....P.......0..............@....rsrc........`.......2..............@..@.reloc..\....p.......<..............@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_socket.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):69912
                                        Entropy (8bit):6.7529275237414
                                        Encrypted:false
                                        SSDEEP:1536:XAqVY6E4oksA1MT9f8+CeJ+8WyKTVVILLwt7SyJPxl:XAqVY3FA1MT9f8DeJ+8W9TVVILLwtvxl
                                        MD5:A092B2DE9E1128F73E26D142A5B2D68B
                                        SHA1:0C5E38B11389ACC870056200710F4152FBB03429
                                        SHA-256:389D2B94A3562879F9E0A17CACE1574EE308AC39A5D9F5659F885284C9B2D19E
                                        SHA-512:60D45D3BEF3C8729CA879816A321B8508AE304A84499E715CB2AD7352273A6482B82C960092311E3EF40F1326D6533CE25B61953A197F7D3FBCE2C0CF511D5E2
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&...b...b...b...k...f...0.`...0.n...0.h...0.c.....`...b......)...e.....c.....c.....j.c.....c...Richb...................PE..L...n.,d...........!.....f...|......tk....................................................@.........................P...P................................/..............T........................... ...@............................................text...:e.......f.................. ..`.rdata...Z.......\...j..............@..@.data...(...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_sqlite3.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):72984
                                        Entropy (8bit):6.755617527508713
                                        Encrypted:false
                                        SSDEEP:1536:a85mWPlKtIGSqpnoOUNGHxvttnGyOuPrF2dRILOQxyO7Syo/PxjP:XmdiHqpjmGx1tnGEzF2dRILOQxheHxD
                                        MD5:389A85E60B7DA2F29AAA738A7BF2B542
                                        SHA1:4C6F51FD4C25F22474667AB8078AD974A9628C5D
                                        SHA-256:8A703DA286CDBC263FE28D0888C03BB899E73B4B7729C44A953CC6139F33E3BE
                                        SHA-512:898506A70DA25E8D181DF7E7790430ABEFCB0C9EECCB0595A1983CE09B6155DD0C72935470FBB9EF0BFA0BFFC953555693FF2FFA2461C10B84578691CD0C7B50
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7@..s!.]s!.]s!.]zY.]u!.]!T.\q!.].Ny]r!.]!T.\.!.]!T.\y!.]!T.\r!.].T.\v!.]8Y.\q!.]s!.].!.].T.\z!.].T.\r!.].T{]r!.].T.\r!.]Richs!.]........PE..L.....,d...........!.........n.......................................................I....@.........................P...P................................/......8.......T...............................@............................................text....~.......................... ..`.rdata...E.......F..................@..@.data...L...........................@....rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_ssl.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):141592
                                        Entropy (8bit):6.519132347042123
                                        Encrypted:false
                                        SSDEEP:3072:Q1ixmpACRnjX8bpl/u3O90wxY77N5ILC792oywBxv:4ixmpPsbppu3zwxWN9b
                                        MD5:1222DAA5C49F53A36D2843CA9BFE513A
                                        SHA1:7A43E326B261E75A05CDFA979B80E95B69080173
                                        SHA-256:69C76B8FE5C873D1A0DFF493C3A3B88090B61EE648AD7681BC0581964465589E
                                        SHA-512:B5BF384D14C3C8221A42288F97D910491730C84BE0A783F5BD17FC2E3DF7F2BB63529571C97CB08064066AA90F07FA00C837944E43DB62E071089A720A8BB551
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_...>...>...>...F-..>...K...>...K...>...K...>...K...>..=K...>..8B...>...>..r?...F...>..=K...>..=K...>..=KA..>..=K...>..Rich.>..........................PE..L...~.,d...........!.........L......t........................................ .......P....@..........................q..d...4r.........................../..........Pm..T............................m..@...............,............................text............................... ..`.rdata..............................@..@.data....J.......H..................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\_uuid.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):22808
                                        Entropy (8bit):6.937211239543495
                                        Encrypted:false
                                        SSDEEP:384:vqIesePwjnE8Gtr5ILZwkeHQIYiSy1pCQiI/NPxh8E9VF0Nyn54qSc:CIeZkgr5ILZwkU5YiSyvT/NPxWElQc
                                        MD5:59F19A807B3E13D8E707C942A38BF84E
                                        SHA1:469DEC6DA89737795C72FF51F69B44462E55099A
                                        SHA-256:7ED17311B391FFFF58F073ECF71829F73629033458A54A435DC62014281A733C
                                        SHA-512:3C10A7B3AF03E1AE95C577FB4FEE108D0ACFF876DFE0FD1079F74DE30881B5F3659AAA1F52A857CEC9C7430248094E896261C297A25C62D4951252A3A74EB48A
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[..:...:...:...B'..:...O...:...O...:...O...:...O...:...O...:...B...:...:...:...O...:...O...:...OK..:...O...:..Rich.:..................PE..L...M.,d...........!......................... ...............................`......5.....@..........................%..L....%..x....@...............*.../...P..l.... ..T...........................H!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..l....P.......(..............@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\base_library.zip

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                        Category:dropped
                                        Size (bytes):1066352
                                        Entropy (8bit):5.6712348464357385
                                        Encrypted:false
                                        SSDEEP:12288:cgYJu4KXWyBC6S4IE/8A4a2YaRxdOVwx/fpEh+rg3u+E0SLMNJ:cgYJiVB+La2xkVwx/fpEh+Iu+E/MNJ
                                        MD5:F2462FAB571A87A8C1884B186CCCAB73
                                        SHA1:13022B2FA4F83EC218E024A85E97454D8DCA2385
                                        SHA-256:4872929FFBAF2FC9F0598DB66B6FEA94EFC58960CA6AFBB1A82EA1E518830991
                                        SHA-512:B43FB2A80057B86DD4E58D86C7F69373259DC0DD76E21FAA3B23E38226CBCBF5D023CB45BE8E7591210BD96816136B21C12FBD870DFE57E1933C22F171F774C1
                                        Malicious:false
                                        Preview:PK..........!..,..5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Z*e*..Z*e.e*..Z+e*.,....[*d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d*..d*e8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\backup_commands_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3851
                                        Entropy (8bit):4.982326391283038
                                        Encrypted:false
                                        SSDEEP:96:OxkNmfIDg1E8zcwkGOIV9WdkgrRhYLVBHrJPIV88grwSzK:TgQsa84wPV9WdPrRhKVtrJAV8HrwSzK
                                        MD5:6988EF78588BD0E8209E9CC8B5D342E3
                                        SHA1:1533EEA95F7D228D6BC2E9E594ACF83119A79666
                                        SHA-256:413EEC4E1B878D16DFC846D7164DD016253F9F30EECE914809D2E23EB66F2355
                                        SHA-512:B236DF28460E052B10717250D151F13F781DFA24B0FB8178D6CCD1CAFD91419CB4EE355F1B1FA9164CA103EC281C0F66CA3FD365CD13B469F1D200EDCE440774
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class CheckBackupRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. SILENT_FIELD_NUMBER: builtins.int. silent: builtins.bool. def __init__(self,. *,. silent: builtins.bool = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["silent",b"silent"]) -> None: ....global___CheckBackupRequest = CheckBackupRequest..class CheckBackupResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. ID_FIELD_NUMBER: builtins.int. id: typing.Text. def __init__(self,. *,. id: typing.Text = ...,. ) -> None: .... def ClearField(self, field_

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\bitbox02_system_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable, with very long lines (309)
                                        Category:dropped
                                        Size (bytes):5248
                                        Entropy (8bit):5.0699310653475695
                                        Encrypted:false
                                        SSDEEP:96:nGkV76NTnaQGpXW/CEI569BaWei1Am0d3gGI4Dzl+iG/hiV0XW9zeasQjjV:d54ja5W/BI569uiCZd3lzgzY2W961EjV
                                        MD5:A17DDB62F276DBB561B515918DDC95EB
                                        SHA1:63370BA2A706796E779CAA3C6534B09F5684F002
                                        SHA-256:54D2D6921A78180D974870386EC4E9C6F0F50CDD7B3C0C5B3D8E88615A760FFA
                                        SHA-512:83819E50975DA79B483B6240BCBC5F0E5CE2C1A44794D48A4C3225A4801205104A2EE207F5ABC86D571DA76D32C7D9E07722820064C658543A8DBB8DB7FC5D1D
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.enum_type_wrapper.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class CheckSDCardRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. def __init__(self,. ) -> None: ....global___CheckSDCardRequest = CheckSDCardRequest..class CheckSDCardResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. INSERTED_FIELD_NUMBER: builtins.int. inserted: builtins.bool. def __init__(self,. *,. inserted: builtins.bool = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["inserted",b"inserted"]) -> None: ....global___CheckSDCardResponse = CheckSDCardResponse..class DeviceInfoRequest(google.protobuf.message.Message):.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\btc_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable, with very long lines (388)
                                        Category:dropped
                                        Size (bytes):33375
                                        Entropy (8bit):5.136269727408597
                                        Encrypted:false
                                        SSDEEP:768:2FSyf8CT3THDKoTScSFPNG730gzFNsdlXMM87Uqu9qmjv/Lqr2XE58TS6fFyHTST:2FSyf8CT3THDKoTScSFPNG730gzFNsd7
                                        MD5:AA42E66D765C8193D5E21F3FBC96992B
                                        SHA1:E368061C6A2401DB353624402C71A4D1CF3D8668
                                        SHA-256:7616DB88EBC403644E3ADFDE37ACBA44FC3EEB881E07838F82FC1A89B480A8BE
                                        SHA-512:5161DF99A69710C2A827024E7D8C1F26BD0D94ED56865C4E2030DF2C46912227F1DD1DB94E53CFE065DE9E4843C2AEFF019299D46D702B245A31D0705327BEE9
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".from . import antiklepto_pb2.import builtins.from . import common_pb2.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.internal.enum_type_wrapper.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class _BTCCoin:. ValueType = typing.NewType('ValueType', builtins.int). V: typing_extensions.TypeAlias = ValueType.class _BTCCoinEnumTypeWrapper(google.protobuf.internal.enum_type_wrapper._EnumTypeWrapper[_BTCCoin.ValueType], builtins.type):. DESCRIPTOR: google.protobuf.descriptor.EnumDescriptor. BTC: _BTCCoin.ValueType # 0. TBTC: _BTCCoin.ValueType # 1. LTC: _BTCCoin.ValueType # 2. TLTC: _BTCCoin.ValueType # 3.class BTCCoin(_BTCCoin, metaclass=_BTCCoinEnumTypeWrapper):. pass..BTC: BTCCoin.ValueType # 0.TBTC: BTCCoin.ValueType # 1.LTC: BTCCoin.ValueType # 2.TLTC:

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\common_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3152
                                        Entropy (8bit):4.9931742238287145
                                        Encrypted:false
                                        SSDEEP:48:OKX8xO9Ie9coB87F8qDO4LyBcjhmlP7OpOhONOPONpNpBwBG5eBKBcwqRqaaZ+3q:OC6JadBGFD5+nlDoycKGvwGcWBmzvPsB
                                        MD5:475776E2B63777A766E1121F4E7F0DA2
                                        SHA1:C393E11514C2CA8DEFE5B102AB89D5ED344DDC52
                                        SHA-256:A81614BF23A09597C6CA2F96EAC36BE27F65FF743E872919F45E7440DD367F45
                                        SHA-512:668D76C46827E0D2E308C92E29AB3049B5B0738463836F4BC0A18CA44605D3A75EFABA97160B522644F1BDCA4CC5EE4E58E4CC09870E6ACD1F8AACD8D2AB2BF8
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class PubResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. PUB_FIELD_NUMBER: builtins.int. pub: typing.Text. def __init__(self,. *,. pub: typing.Text = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["pub",b"pub"]) -> None: ....global___PubResponse = PubResponse..class RootFingerprintRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. def __init__(self,. ) -> None: ....global___RootFingerprintRequest = RootFingerprintRequest..class RootFingerprintResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\eth_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable, with very long lines (309)
                                        Category:dropped
                                        Size (bytes):19589
                                        Entropy (8bit):5.09832628113467
                                        Encrypted:false
                                        SSDEEP:384:YA1AbKmuBTqCcKEn6u6T86uwORnAJR5vbPbTSV6s6oi7+J5JsRtHy:YWAbKmuBTqCcKEn6u6T86uwORnAJR5vw
                                        MD5:1D34C55C7121BD3695CFC6C73381DC0C
                                        SHA1:1AB53605573FA267FD457B284AEC6507D7C40857
                                        SHA-256:E45729EF836A6202048AF41997D058846959ED9CA705E434BE6760313E7EF64A
                                        SHA-512:590DB0ECABA1470D60710649E363E49D8496EA205BBE2E522D788BBB288916740D86D68C44ECAD83B00C985F28B74604E3A430E879694727CE909ED278824710
                                        Malicious:false
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".from . import antiklepto_pb2.import builtins.from . import common_pb2.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.internal.enum_type_wrapper.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class _ETHCoin:. ValueType = typing.NewType('ValueType', builtins.int). V: typing_extensions.TypeAlias = ValueType.class _ETHCoinEnumTypeWrapper(google.protobuf.internal.enum_type_wrapper._EnumTypeWrapper[_ETHCoin.ValueType], builtins.type):. DESCRIPTOR: google.protobuf.descriptor.EnumDescriptor. ETH: _ETHCoin.ValueType # 0. RopstenETH: _ETHCoin.ValueType # 1. """Removed in v9.14.0 - deprecated""".. RinkebyETH: _ETHCoin.ValueType # 2. """Removed in v9.14.0 - deprecated"""..class ETHCoin(_ETHCoin, metaclass=_ETHCoinEnumTypeWrapper):. """Kept for backwards compatibil

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\hww_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable, with very long lines (926)
                                        Category:dropped
                                        Size (bytes):13514
                                        Entropy (8bit):5.139264229998885
                                        Encrypted:false
                                        SSDEEP:384:Gqw/WO8nXG7KgysmifAs21OgFNwnyGmGAWHWq4atFxxuxhc+cNfSv8YisYFDGcCu:Gqw/WO8XG7KgysmifAs21OgFNwyGmGAK
                                        MD5:1F4404FED86A2D3B1052A995C06B1DAC
                                        SHA1:548F5125246006890A6D2CAB0B9AFB09ABBCADAB
                                        SHA-256:B7D6EA2DBFA9FB758ECD6F0D90ECA2878AAFB23503E4791F0D7077457CE89A46
                                        SHA-512:2BC7B255562628C0FCF364DAE38C89C88EC25680CF1B5A7EDD52C0F89747B5863F4946DC3467EF62154586D0CC46AFFB8840765C9B33A338C6F742E56EA5F2C7
                                        Malicious:false
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".from . import backup_commands_pb2.from . import bitbox02_system_pb2.from . import btc_pb2.import builtins.from . import cardano_pb2.from . import common_pb2.from . import eth_pb2.import google.protobuf.descriptor.import google.protobuf.message.from . import keystore_pb2.from . import mnemonic_pb2.from . import perform_attestation_pb2.from . import system_pb2.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class Error(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. CODE_FIELD_NUMBER: builtins.int. MESSAGE_FIELD_NUMBER: builtins.int. code: builtins.int. message: typing.Text. def __init__(self,. *,. code: builtins.int = ...,. message: typing.Text = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["code",b"code","message",b"message"]) -> None: ....glob

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\keystore_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1308
                                        Entropy (8bit):4.960417044026867
                                        Encrypted:false
                                        SSDEEP:24:kGrF3aHNKtG1rZ4ntdmZBEOdAMkFLJAYMcXCQ/iMdmZBpOjSAlTcXQixiTn:OKf8EOZ6sciY8pOWyclET
                                        MD5:7926D8BDCCFEA930CBD2A2FB28298C9F
                                        SHA1:6139C9CD1F56BE76C6E1DEE73079BA22696AFBBC
                                        SHA-256:AB23047FFF35ED2B7FAE0283375992BE60D501CB3F0B0053CB97770FE31543E9
                                        SHA-512:4A28958F6165C860382BD9491E461E3A11DACBEFD84D269602DDA0FE1D920EF7325E44B1265A13A87793C66AF325E1F4B416B6364B72D35A34B8CEA7DE79C18E
                                        Malicious:false
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class ElectrumEncryptionKeyRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. KEYPATH_FIELD_NUMBER: builtins.int. @property. def keypath(self) -> google.protobuf.internal.containers.RepeatedScalarFieldContainer[builtins.int]: .... def __init__(self,. *,. keypath: typing.Optional[typing.Iterable[builtins.int]] = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["keypath",b"keypath"]) -> None: ....global___ElectrumEncryptionKeyRequest = ElectrumEncryptionKeyRequest..class ElectrumEncryptionKeyResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\mnemonic_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1541
                                        Entropy (8bit):4.953918413828606
                                        Encrypted:false
                                        SSDEEP:24:kGrF3ayGrZ4TdmZB7AmdmZBkOXOavzRAwUwcXVZ1vThz1dmZB/OE17AS0cXQz0zy:9x87L8kOXOwzRcwcRR8/OEZB0ca
                                        MD5:878BA6A31A34C344BFC3D7F916C21857
                                        SHA1:9E56171DDCAB1412974020AF7ADEDA116D327A8C
                                        SHA-256:22EBFAA989850D8A759F23304D66BF975C15D9CD0B8CD59EEAFA01A2A474DA72
                                        SHA-512:DD20C9446B1B6A4B72668DBE563D21932745026CB1AB553E1E568FF6C0E5526E4EB9338136CB3D72EE46DA7D98F117D721FF2D5F490FD857CB81232B4AB8E4AD
                                        Malicious:false
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.message.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class ShowMnemonicRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. def __init__(self,. ) -> None: ....global___ShowMnemonicRequest = ShowMnemonicRequest..class RestoreFromMnemonicRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. TIMESTAMP_FIELD_NUMBER: builtins.int. TIMEZONE_OFFSET_FIELD_NUMBER: builtins.int. timestamp: builtins.int. timezone_offset: builtins.int. def __init__(self,. *,. timestamp: builtins.int = ...,. timezone_offset: builtins.int = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["timestamp",b"timestamp","timezone_offset",b"timezone_offset"]) -> None: ..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\perform_attestation_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1990
                                        Entropy (8bit):5.024193639757406
                                        Encrypted:false
                                        SSDEEP:48:9VwDXOi+69BcnVwYOB/OzOVOOOvYjMB63BxKBlMpBUBfBcSckUw:PAjT+Vn20YRkKw6x8lQE5PUw
                                        MD5:FA9B13FCDE2A27D056BDCF511923EC4F
                                        SHA1:DF9598AAFFF3BCB14870D8BB5B155B23687C1E17
                                        SHA-256:7B6C5A3996BFFDFFF9C224FC332635A9D4B9F29D730AF6A3983DAA14123DE79C
                                        SHA-512:1D5C9C4A6B43B440079950BDFBA539D7E980202CB4E34F66160EF56FD39A8F3CD3219EC0087469C9B1F7D38CFD8C5D22E1D1C27F71419EE33962307CFFFD4B24
                                        Malicious:false
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.message.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class PerformAttestationRequest(google.protobuf.message.Message):. """Deprecated, last used in v1.0.0""". DESCRIPTOR: google.protobuf.descriptor.Descriptor. CHALLENGE_FIELD_NUMBER: builtins.int. challenge: builtins.bytes. """32 bytes challenge.""".. def __init__(self,. *,. challenge: builtins.bytes = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["challenge",b"challenge"]) -> None: ....global___PerformAttestationRequest = PerformAttestationRequest..class PerformAttestationResponse(google.protobuf.message.Message):. """Deprecated, last used in v1.0.0""". DESCRIPTOR: google.protobuf.descriptor.Descriptor. BOOTLOADER_HASH_FIELD_NUMBER: builtins.int. DEVICE_PUBKEY_FIELD

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\bitbox02\communication\generated\system_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1394
                                        Entropy (8bit):4.908402032806933
                                        Encrypted:false
                                        SSDEEP:24:kGrF3aHkG1rZ426dmZBR7FYC9Mfuva/N7SOxa2cC2ZhUn6W/rWC+u6WQDOJVYAHx:NN8R7eX7SnITn6YWC+u6DO06cx2
                                        MD5:D283654C86077E18CD61D581C02894F4
                                        SHA1:2AFF38170C43FF33480D80A93D47094E4258160B
                                        SHA-256:C8AA69CC36271BBF0ECBC5947F10169E97AC65624B244D4D19BFD68E78427CB3
                                        SHA-512:456927D2F2FD5495E04133BA8E89BAC36BC03250BC5BD2AA828642D574BF474A62D77F16E0EF9280C3A3A5FCCEC2835D912EAB02FB79F82C8563753766F4A2EF
                                        Malicious:false
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.enum_type_wrapper.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class RebootRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. class _Purpose:. ValueType = typing.NewType('ValueType', builtins.int). V: typing_extensions.TypeAlias = ValueType. class _PurposeEnumTypeWrapper(google.protobuf.internal.enum_type_wrapper._EnumTypeWrapper[RebootRequest._Purpose.ValueType], builtins.type):. DESCRIPTOR: google.protobuf.descriptor.EnumDescriptor. UPGRADE: RebootRequest._Purpose.ValueType # 0. SETTINGS: RebootRequest._Purpose.ValueType # 1. class Purpose(_Purpose, metaclass=_PurposeEnumTypeWrapper):. pass.. UPGRADE: RebootRequest.Purpose.ValueType # 0. SETTING

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\certifi\cacert.pem

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):292541
                                        Entropy (8bit):6.048162209044241
                                        Encrypted:false
                                        SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5NF:QWb/TRJLWURrI55MWavdF0D
                                        MD5:D3E74C9D33719C8AB162BAA4AE743B27
                                        SHA1:EE32F2CCD4BC56CA68441A02BF33E32DC6205C2B
                                        SHA-256:7A347CA8FEF6E29F82B6E4785355A6635C17FA755E0940F65F15AA8FC7BD7F92
                                        SHA-512:E0FB35D6901A6DEBBF48A0655E2AA1040700EB5166E732AE2617E89EF5E6869E8DDD5C7875FA83F31D447D4ABC3DB14BFFD29600C9AF725D9B03F03363469B4C
                                        Malicious:false
                                        Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\cryptography\hazmat\bindings\_rust.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):5105664
                                        Entropy (8bit):6.747499713859597
                                        Encrypted:false
                                        SSDEEP:49152:rHWs7jO0dKPCZL/CIpNsIf0HszAwDrvibENUffZi97n8gKdDoRSkET7pmfi+zfJg:rHW0OtCZL/C3HsrDibE+fOOouT4qnB
                                        MD5:871133E95B9704B35E6192C136949520
                                        SHA1:B6D0BA578A1CFABB5CCB4169250BB58910984568
                                        SHA-256:8D33F22574E8778C21BD7F395FABDCC996F3E22E91CF0489298499884C88BC91
                                        SHA-512:8DFF4837C8F73090E45927D61FCAF25E7D2DDD20EE29612CA94CFD62E80679EDCF1607B448719121B2ACB1BF55A5C6C9F20E1A9FF9A0D2011B7B1669E83FF3D8
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.......................................................-...........5.........-...e...x...............x.......x.......Rich............................PE..L....f.e.........."!...&.0=.........;.<......@=..............................0N...........@.........................`aJ.p....aJ.|............................@K.......H.T.....................H.....0.H.@............@=.h............................text.....=......0=................. ..`.rdata..XA...@=..B...4=.............@..@.data........J......vJ.............@....reloc.......@K.......K.............@..B........................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\bip39_wallet_formats.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):3308
                                        Entropy (8bit):4.46082568411814
                                        Encrypted:false
                                        SSDEEP:96:EHtrrarfTWeeWxbexSb6mtD2+8+PTWIDVjrTTte+g:zm
                                        MD5:46CA7C7E51E5F0604DEACF218A0F50E8
                                        SHA1:9BB4D19739AB70AD29ED7F94F672B167E7A1CE53
                                        SHA-256:1C5215598A86EFB728754270A91076B653A14D7EAE33BE25C7DE02405E4F329B
                                        SHA-512:C3D64329EEA3B6024E9D0C0241AF88E53A00E32D8BC3E86C5835ED0120294655C1753ECEC8037559CC59D0E42C13E2FE025ED0FA57F04F7A0DD39476A28ED5FC
                                        Malicious:false
                                        Preview:[. {. "description": "Standard BIP44 legacy",. "derivation_path": "m/44'/0'/0'",. "script_type": "p2pkh",. "iterate_accounts": true. },. {. "description": "Standard BIP49 compatibility segwit",. "derivation_path": "m/49'/0'/0'",. "script_type": "p2wpkh-p2sh",. "iterate_accounts": true. },. {. "description": "Standard BIP84 native segwit",. "derivation_path": "m/84'/0'/0'",. "script_type": "p2wpkh",. "iterate_accounts": true. },. {. "description": "Non-standard legacy",. "derivation_path": "m/0'",. "script_type": "p2pkh",. "iterate_accounts": true. },. {. "description": "Non-standard compatibility segwit",. "derivation_path": "m/0'",. "script_type": "p2wpkh-p2sh",. "iterate_accounts": true. },. {. "description": "Non-standard native segwit",. "derivation_path": "m/0'",. "script_type": "p2wpkh",.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\checkpoints.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):65410
                                        Entropy (8bit):3.98763136223524
                                        Encrypted:false
                                        SSDEEP:1536:gvjv9+0ZVWQgy2x8zlOcG3aqGS5ylztlHxNbTv:2C8YYpP3D
                                        MD5:D9E2C5C93CF5036D0E9C6123251A0480
                                        SHA1:042054F9E3CC9C13ED348EB4FC34D531B328403C
                                        SHA-256:1D723ACA3C3C6FDD8C98A12FF65CF24F8BB521FFD60831E1E778C5A843EA3349
                                        SHA-512:4C66113E647CCEAC541626E861088E1EC434EA770AA37D305610F26633714619C4A1FCE71BCEB1989866233BDB7E636468FD80FF76EB177999B62C3983161C96
                                        Malicious:false
                                        Preview:[. [. "00000000693067b0e6b440bc51450b9f3850561b07f6d3c021c54fbd6abb9763",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "00000000f037ad09d0b05ee66b8c1da83030abaf909d2b1bf519c3c7d2cd3fdf",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "000000006ce8b5f16fcedde13acbc9641baa1c67734f177d770a4069c06c9de8",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "00000000563298de120522b5ae17da21aaae02eee2d7fcb5be65d9224dbd601c",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "000000009b0a4b2833b4a0aa61171ee75b8eb301ac45a18713795a72e461a946",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "00000000fa8a7363e8f6fdc88ec55edf264c9c7b31268c26e497a4587c750584",. 26959535291011309493156476344723991336010898738574164086137773096960. ],.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\checkpoints_testnet.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):138404
                                        Entropy (8bit):3.921069131385325
                                        Encrypted:false
                                        SSDEEP:1536:wTfJux0vjeByZDtPsfCNOXcrFasvJa+tngIce4CHIyZjbfHTJr13gR0z:k5ScZaCNTrF3ngXUjrFr13gC
                                        MD5:B050FB77E90ECF4B8235CD5BD1251651
                                        SHA1:B260CFDCC3384D386917DFC04B4690F06A6C6951
                                        SHA-256:9E7B01F5DE5F1FDFC28BA0E638F2723D8DDB6E5CDA041EE662552F7145ECE8D7
                                        SHA-512:3921B806E30DE8FFAB8956005030305D5C9703365BFB3E94D27E16874BCB41394749F986FC0123C716C775A69460F3EBC0AECCDA5743E79F5E79EC7680700C9B
                                        Malicious:false
                                        Preview:[. [. "00000000864b744c5025331036aa4a16e9ed1cbb362908c625272150fa059b29",. 0. ],. [. "000000002e9ccffc999166ccf8d72129e1b2e9c754f6c90ad2f77cab0d9fb4c7",. 0. ],. [. "0000000009b9f0436a9c733e2c9a9d9c8fe3475d383bdc1beb7bfa995f90be70",. 0. ],. [. "000000000a9c9c79f246042b9e2819822287f2be7cd6487aecf7afab6a88bed5",. 0. ],. [. "000000003a7002e1247b0008cba36cd46f57cd7ce56ac9d9dc5644265064df09",. 0. ],. [. "00000000061e01e82afff6e7aaea4eb841b78cc0eed3af11f6706b14471fa9c8",. 0. ],. [. "000000003911e011ae2459e44d4581ac69ba703fb26e1421529bd326c538f12d",. 0. ],. [. "000000000a5984d6c73396fe40de392935f5fc2a8e48eedf38034ce0a3178a60",. 0. ],. [. "000000000786bdc642fa54c0a791d58b732ed5676516fffaeca04492be97c243",. 0. ],. [. "000000001359c49f9618f3ee69afbd1b3196f1832acc47557d42256fcc6b7f48",. 0. ],. [.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\currencies.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):13589
                                        Entropy (8bit):2.9049133687933306
                                        Encrypted:false
                                        SSDEEP:192:07m8rWrq9bzab8rbWrqu6jWBhd8rWrq3/8rno8rbWr7b8rf:0xza5POy
                                        MD5:98F790C46325F2663FB8C4301A762FA2
                                        SHA1:00E1F57575A71C4FE1972DC1A08600399AB936D5
                                        SHA-256:608DEEDC9FA24701E9D1AA834B231CB8DB6EC014FE03353BD589D6BB6B82AF39
                                        SHA-512:B13C175C92C6096BA6360485E378EE030FBC8FAFF525896D3D3445EDCD91120EAAD1C343DAE756C82C641CE80344456AB8248710035AD86132AEA5F9E6B3CDF2
                                        Malicious:false
                                        Preview:{. "BitFlyer": [. "JPY". ],. "Bit2C": [. "ILS". ],. "BitPay": [. "AED",. "AFN",. "ALL",. "AMD",. "ANG",. "AOA",. "ARS",. "AUD",. "AWG",. "AZN",. "BAM",. "BBD",. "BCH",. "BDT",. "BGN",. "BHD",. "BIF",. "BMD",. "BND",. "BOB",. "BRL",. "BSD",. "BTC",. "BTN",. "BWP",. "BZD",. "CAD",. "CDF",. "CHF",. "CLF",. "CLP",. "CNY",. "COP",. "CRC",. "CUP",. "CVE",. "CZK",. "DJF",. "DKK",. "DOP",. "DZD",. "EGP",. "ETB",. "EUR",. "FJD",. "FKP",. "GBP",. "GEL",. "GHS",. "GIP",. "GMD",. "GNF",. "GTQ",. "GYD",. "HKD",. "HNL",. "HRK",. "HTG",. "HUF",. "IDR",.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\Electrum_512.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):174386
                                        Entropy (8bit):7.968500119111208
                                        Encrypted:false
                                        SSDEEP:3072:m4EU4nvqLgn2cQtfeafQuJt5ioqmfdXV11gMdHtTeu:Mvqk2T/Jt5ioLf1V11gMJ8u
                                        MD5:86B79DFCB64DE8DDFFDAF1BED393C9A6
                                        SHA1:C78609FFB571BA419CA1D869BD03CE8A3834B03B
                                        SHA-256:9E68B49C2AA7E6FBF7F456CE20B18BA98D6F85A0161DA240901D4A7DBA464CBD
                                        SHA-512:B7CD296707FEE4B4C3A21989AC613D3994A2E60934372A22B903C0FE9E585CB1940F78DD8D4B93D2CC56BAB5F38908193E18BFA00514C1381B0DC9E4DC84BBB0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............x.....AiCCPICC Profile..H...wTS....7..." %..z. .;H..Q.I.P...&vD.F..)VdT..G."cE....b....P..QDE..k..5....Y.....g.}..P....tX..4.X....\..........X...ff.G.D....=...H.....d..,.P&s...."7C$...E.6<~&....S...2.....)2.12....."..l...+...&..Y...4...P.%...\.%.g.|.e.TI....(....L.0.._..&.l.2E.........9.r...9h..x.g...Ib...i...f..S.b1+..M.xL.....0...o.E.%Ym.h.....Y..h.....~S.=.z.U.&..A..Y.l./....$Z.....U..m.@..O. .........l^....'....ls..k.+.7...o..9.....V;..?.#I.3eE..KD......d......9i...,......UQ....h..<.X..d.......6'..~.k.hu_.}.9P.I..o=.C#.$n?z.}.[.1...h...s.2z.....\.n.LA"S....dr%.,...l.....t..4..0.,`...3p.. ...H.....H.i@..A>...A1..v.jp..z..N.6p.\.W..p...G@...K0..i......A......B...Z.yCAP8...C....@..&..*...CP=.#t...]..... 4...}.....a......;..G...Dx.......J..>........,._..@....FX...DB.X$..!k."...E.......H.q.....a......Y..bVa.bJ0.c.VL..6f.3....b..X'.?v.6...-.V`.`[.....a.;.......p~..\2n5...........&.x.*.....s.b|!.........'..Z.k..!. $l$T

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\Electrum_square_512.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):175987
                                        Entropy (8bit):7.947889831396768
                                        Encrypted:false
                                        SSDEEP:3072:XXkxLtz/rdEk4jZOGVy/NuguOWsOe0kOYuUDDMCWfU6qbC52XC/PrI7lWt:kPY1KGOWhe0kOcDDTqPq+5NI6
                                        MD5:843B877B6083178C37566EB49012D518
                                        SHA1:3D30E35B39687DF2914EABC70857A986C13D9ADC
                                        SHA-256:780A4BF68902A306C2CE24B8424F68BA91875D99D13EC8A2CF05AAAFA9B23624
                                        SHA-512:C8AA04DFADCE3E34F0B2D00762854E04EF65BC6311058B18B0ECD6DDE6130E004A8626498EF5D21ED8C30C26C685D9CD21CD37BC281A79E16ACEB52AA037763A
                                        Malicious:false
                                        Preview:.PNG........IHDR..............x.....AiCCPICC Profile..H...wTS....7..." %..z. .;H..Q.I.P...&vD.F..)VdT..G."cE....b....P..QDE..k..5....Y.....g.}..P....tX..4.X....\..........X...ff.G.D....=...H.....d..,.P&s...."7C$...E.6<~&....S...2.....)2.12....."..l...+...&..Y...4...P.%...\.%.g.|.e.TI....(....L.0.._..&.l.2E.........9.r...9h..x.g...Ib...i...f..S.b1+..M.xL.....0...o.E.%Ym.h.....Y..h.....~S.=.z.U.&..A..Y.l./....$Z.....U..m.@..O. .........l^....'....ls..k.+.7...o..9.....V;..?.#I.3eE..KD......d......9i...,......UQ....h..<.X..d.......6'..~.k.hu_.}.9P.I..o=.C#.$n?z.}.[.1...h...s.2z.....\.n.LA"S....dr%.,...l.....t..4..0.,`...3p.. ...H.....H.i@..A>...A1..v.jp..z..N.6p.\.W..p...G@...K0..i......A......B...Z.yCAP8...C....@..&..*...CP=.#t...]..... 4...}.....a......;..G...Dx.......J..>........,._..@....FX...DB.X$..!k."...E.......H.q.....a......Y..bVa.bJ0.c.VL..6f.3....b..X'.?v.6...-.V`.`[.....a.;.......p~..\2n5...........&.x.*.....s.b|!.........'..Z.k..!. $l$T

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\add.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):687
                                        Entropy (8bit):7.377532436950315
                                        Encrypted:false
                                        SSDEEP:12:6v/7JZEVEG9X6fWYJzggenHHHGadWUmvS7jx0HvgutsLK79DoQmRJV9HP8m:saVTAfwJHHH7cS/xKgtLYDon9Em
                                        MD5:306C508E41649D8BFF7C7D8922AA8139
                                        SHA1:3EBABCAF901ADED58811E88A45DD97CAA2060A2C
                                        SHA-256:04D8CDA81A29DA1F0198FE8B2A6FA6537E5FF2F7124EBB61F0CAAC64710F253C
                                        SHA-512:5D1AE05F95E8E59155AA6ADF4A8A6960206200C89F08C7F9D55E5643D08A92D0D26CF0F0290AE29C08F1A02D2CBED9B1093CBD424A0BEBB158B9DB1671554470
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....pHYs.........c......tEXtSoftware.www.inkscape.org..<....<IDATx..=..Q...3w.d.B....."....lk+..'..+......~....#.X.v6+..+.+Y&.c...n2W.r.8.@.9.y&.C.LDU.2.u.k\.u.k\.u.k\.u.k:/...Ln..D......d.E.H........da.R.............tx..p....:f.~..P.....m......`....`....`....`....`....`M......M...;(g.:.JA.U8...&..Py..._.........(=.......m@Q....~.5.r[Y..FK....`7-....}..?.....`."E.)........)...>......E..X..........+.....`<g1..X..RD....L..&,..KI..(z.w....|*..g(_b.Z.....r.:O..._..y..98..J...^@....*.H..;.NJ..J...L.>.x...o.."....X....X....X....X....X....X.y..o...t..'bs.d>..a..jD../...~.Ld...h.vq....M..$."........X....X....X..J.r.q..L....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\android_electrum_icon_background.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 432 x 432, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1349
                                        Entropy (8bit):3.151366413748389
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPkVsCsyRYTZDn+sn+FsH+sH+sn+FscPsH+sn+FsH+sH+sl+sH+sn+FsH+sV:6v/7klBRYTZDJ
                                        MD5:EB7D708191A38F982841DB110BDBBE89
                                        SHA1:46D751BEDE5751B188B3227581ECCF959855300B
                                        SHA-256:02A6F4521D0656103369D6CE3EAF7E314289B342F8B67DB00592A3C409ED6D80
                                        SHA-512:B0A9C9F106BF2AE9AC57C30AC195669BFF31B32D86837FA9D61B48A2854E41277D7B4FA70545FF762F51FC703234383429086D35EAEFAD7B540F5E122440D7C4
                                        Malicious:false
                                        Preview:.PNG........IHDR..............N0*....IDATx...1.......7.*8Hz...U..<$...................``.``.``.``..............................``.``.``..............................``.``.``..............................``.``.``.``..............................``.``.``.....................``.``.``..............................``.``.``.``..............................``.``.``..............................``.``.``..............................``.``.``.``.....................``.``.``..............................``.``.``..............................``.``.``.``..............................``.``.``..............................``.``.``..................................``.``.``..............................``.``.``..............................``.``.``.``..............................``.``.``..............................``.``.``. ...................``.``.``.``..............................``.``.``..............................``.``.``..............................``.``.``.``..............................`

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\android_electrum_icon_foreground.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 432 x 432, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):23973
                                        Entropy (8bit):7.9504694279167945
                                        Encrypted:false
                                        SSDEEP:384:XkyL4VmLi000d3ui6AWxSLpFipUfWuyVTnl0+n25TT7D3LBwyZ56JwDcHMfG:0Ov+0NFui6AWleWVnO+n25TT/LeyiIX+
                                        MD5:EC88544988E9C6E6147D5ED34D6A6792
                                        SHA1:7C53FD17F58ECB44FEE4CFAC4D0420D1DF45D6C3
                                        SHA-256:F53007686FBCFABBDA4C4EAADE316641363E3B4A2DA67CD445A231BA44C70D28
                                        SHA-512:46128BF02E4E757999D4FD3A26C8C47C128EF3E97986F8C69F1862E577D9A46CEFC4C40A505A364AAF4D540D8230F56A00E256443DEDDCAE03FD01D1974DD110
                                        Malicious:false
                                        Preview:.PNG........IHDR..............N0*....iCCPICC profile..(.}.=H.@.._.E+.v.q.P.,._8J..`...Zu0....4$)...k........... ......"%./).......=...B..T30...e..11.[.._.@....%f..b.....>..Ey...?G..7.....nX...3...y.8.J.B|N<f...........3.F&5O.&...,w0+.*..qDQ5....+..8...k..0..V.\.9.8..@."d.PF....j..H.~..?.....U.#...P!9~.?..Y..p.B1...?F..].Y...c.n...g.Jk...`...z[.......u[.....`.I....4.B.x?.o....@..[k...@..Z......"e.{.;...gZ...JOr.........bKGD..............pHYs.........B(.x....tIME.........?.. .IDATx..w`....3..f........PL3.%.SlJ.D...y.B.BH...f.$...@.[....lI.)../..B.S........+iv.*...V.y..mS.{.o.s...0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\android_electrum_icon_legacy.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):13047
                                        Entropy (8bit):7.960630338437363
                                        Encrypted:false
                                        SSDEEP:384:PmQb6xaK2/Npfno80h2yUGnnj393G6zT4o:PBJX/Tf90hvUGnj393VzTl
                                        MD5:84B454208A0EFB0F9A3C1DDCB0E12A35
                                        SHA1:766685D6287CB52A3679DB3FDE27BE192DBB5FCB
                                        SHA-256:38DE29E991C770720C609AE6CF4418CD59C8EC6D20A364738806896C79C99A21
                                        SHA-512:E8679AD177DA85310FC759369E00236C2686A030C17094B93B405B66296847FC1DE36A8CA5A50A1E5F9873B44478D4ED5ED1DC789DCE796714C9B61FD1C1B67E
                                        Malicious:false
                                        Preview:.PNG........IHDR.............R.l.....iCCPICC profile..(.}.=H.@.._.E+.v.q.P.,._8J..`...Zu0....4$)...k........... ......"%./).......=...B..T30...e..11.[.._.@....%f..b.....>..Ey...?G..7.....nX...3...y.8.J.B|N<f...........3.F&5O.&...,w0+.*..qDQ5....+..8...k..0..V.\.9.8..@."d.PF....j..H.~..?.....U.#...P!9~.?..Y..p.B1...?F..].Y...c.n...g.Jk...`...z[.......u[.....`.I....4.B.x?.o....@..[k...@..Z......"e.{.;...gZ...JOr.........bKGD..............pHYs.........B(.x....tIME..... ....... .IDATx..w..U.......=...K....R ".U..+....*"W. JGl.U.].^+.U.....!!.$..M..}w.s~.....3.;3.....l.gg.s.....{.E......).`.......,X..`.".....,X..`..E...,.X.`.......,X..`.".....,X..`..E...,.X.`.......,X..`.".....,X..`..E................ 4.CO.4m.@.0...P6.....`......:.X.x....&..F...../.{A..%........-.yv..Na5L\.e.!...K...D.........P..j.._..J..o....`.0.|..O.2..u.Z.'7.....}.......P8..........?..:....*.........d.8.g....7G;...f^.#.gT.._.B.^..;h.b.`.b....2..e...=......^..g.^.S....9..n8.<.x."....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\bitbox02.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1622
                                        Entropy (8bit):7.798153879675446
                                        Encrypted:false
                                        SSDEEP:48:wtv8Yupelq7Hx+iEOQmcYAUp6Dcvtidb9b2:wtEYJq7H1EbfYAxmMU
                                        MD5:88C67545CEE57297FB2ECB848EE28A0C
                                        SHA1:2B69CD4AF96A93B85B2CDC4589D27AC8DE6FECF1
                                        SHA-256:4F03939FCACEBBC2D33C82436E7B204C8C4A84E51B0E7AF1D1731837B13BB827
                                        SHA-512:7205B254116DB1493A04E50974B70E1F8017B2C6ACF96280FEA6F92D4041B69B7F2CD1DCECC11BB903E995041A11024805D79285B6B2E85730C9926E827DD831
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...k.G..G......98.*.r.r.......`.-..........s...]..>&H..RH.P..B"..tHA...C`...]!.f.3...$........g.{..1#####.Y.eYq*.*-*5*.CE.\.J.J...`..%1....%'.-.J...E..T...]t....Uu....Uc..d.7.V.V.5|x.V..]i.mM}.TqS.).JV2..p*`...d.x<n...!....t.I)3!...08.)^.....r..<T.).h....- ....N..J.r7...h... ..../..^qr......0......p...@...4...@...4...@...4...@......5......tI?.&...2X.R7..Z..~.Q.Po.W..pu...qS{...*..N.`.9.$.....m7.H.p{,]...D......{...d..o.2J.Lm...mG.....7..0.Zt.t...K..;.... n:N...=~..8.....A...0t.s}}=.#...K-......gF....._....z,..4...h....S".F....C.y<U...........(....O..b..-..u"H...;...*.j.SA.(D.@..L9....S.S.z.}./2..0.1.n.xD.....`..!@.......#V..o.;.,<.{.e/Z...Mv.......O...5.._...yMq..M..X>...EH5.{.d.ruu....9.j.*<...9.....k6?... w.....!....#.D.k!7....w||..,[YYa.D......m....u..o....=.......3...#...y/...J%. 4L.....q.ZZZ...].@..P...._.D[.<.s.<.....8.... ,...p.c..8.....C.{.P...8.r.......{.}..=.x....W.Z

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\bitbox02_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1629
                                        Entropy (8bit):7.834581298925457
                                        Encrypted:false
                                        SSDEEP:48:3K0Ht2XF2vs/qLLvlhUpMX3FFlXSVB8QVM/kM7DyR+:TLvs/qlhUpMHtXSDukM7L
                                        MD5:8259D1CC28BFE5ADB3F3F3EDBDE387A6
                                        SHA1:53C5BD011D29674CBF48A88A27AB55E137A31099
                                        SHA-256:E7E0D0669C13930D9460F570CAF1627ECC41001F3E09E001CC1BB33DF589D9B5
                                        SHA-512:E6C30802EFC171EFA6E16DC968EE94CE3F9EAB06C41E1EA8EDE6014FB6A233D2B4CEE0CC4E4E84F835CB8F1189CF7C457E3E5FE7C3D3745E0EDE487587869836
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............tEXtSoftware.Adobe ImageReadyq.e<....IDATx..\=L#G..;...&B..@...$..&>.D..H..4.....4.B.\....... ....W.B.d.(bG....B .b..3.2....wfvfY.|.....7.o.]B,,,,,,....F7.9*.*.Tr..1.T....h.....O\..JC. w.Zj.j..,U@[.7.L...T.+..OJ..*....T1.J..8>>nz.V.5....0q..A.....!t.gggdww......299Iz{{/.....988 ...dpp.tuu.\...U*.R...y.2.8sa...@...."D..eG....2.D{....W*..F` ......Uu....s.......9.^.b%...q......X.B.lmm9$......S.0Q..y..H\__.U.....h...Z.-,..@K.%...h...Z.-,....M`..j.m....%...0..............T>I...*pRX....b.8{e......O.x.W....b...3v..p.].Z....y....N..>...J........ .:..U.p....>..&5.....7....4...<777/...h0g.af*.a.7pMXT~v,h....S.*....=55u.iL.LU..c....@.o__.o0a..@.q..........}<....-n.....M.L..}U.C....l...Kl..K...E..1..R&.g.Y...vk.H.X.6>.~(..Vb...O.T....g".&..y...o......_....j.T.W.. ..............Jl.........'.?>%g..%.....C.w?.L.M^.51V..a.8Q_.T.d.......D~..?/.=&.?.Al.(...<I...........D@.4N.Ly...w....h..._;&+...>...9...(.#F..Yp..."....A\._.ibL,..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\bitcoin.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):8928
                                        Entropy (8bit):7.948051857397655
                                        Encrypted:false
                                        SSDEEP:192:dS8r6wty6g+DOXzBx4nuCy4aYHTgo/lZD4TuxS0gCfpzgUwpR3cNFAYuisr:c82wtGXtKOouuNfhApa8YNsr
                                        MD5:E2258D34BC7FBA986F19971C17B47D6E
                                        SHA1:109354F506805E780F9CBC349185F060EFC9E8CE
                                        SHA-256:E7F66AFD718A21082807DD948CC6E9B06D0CF3BD3181B2A92574E39A3AE4724F
                                        SHA-512:3D355087020939EF9DF370FA531DDA4933319E1BC750F899FB47AB2C7C6A2FC64CEA0E8A8DB711BB811069A387455F37D0F7529516B1DD749445DC281372EC7B
                                        Malicious:false
                                        Preview:.PNG........IHDR.............>U.....bKGD..............pHYs.................tIME............. .IDATx..y....?ou...0.(.FE....Yq.WC..Q._.r..11h q$.J".,....!.....Bv.Y.f\.........L..LwW.?.}X.....|...Q......9.wQ..[F..k.6Bq.........b9.:..^....l.H....?.....Q.Ay..pl../e..8......pCT:...4..!.[...d)~.#.-.x3J.L.....`.b.....H......^m..K....g%.q..b..X.cI..`...b....H@..%M.Iz-......M($(.....x....j.S..J.._...+......).Y..pE!.96.d%...d.X.....p.U..P.W.O...=......'_/.G......7.U.S.X..U.9.G]{.`I.E.V...hj.M.v...+:....nY(.X..H...,....X..G.g.^Q...7.QW$.G(...H .P..^.@.....".8B..xE.B....#.`.l/..#.`.."I.#.`.W$.G(...H .P..^.@.4.W$..G..).X..I$....^.@.....".8B..xE.q..,....W.z..]Q.)4>....2...-.,.#.,...O+..*....M...G..{.z.6......A..V.....x.Cu...~..`O.C.......x....T.}m7..6..9Um.Y..J....+.7:T?s3...g.^t.....Wh..&...eE[1.s......x....^.uW..3.....?.b.b...X.x#_.d.....>..9.7.s.V.....M..uc.]...iT.(G....v.|...YM.kS....+....8...L.yS..g..ny....y......ua...|...ua..M..`..@w...h.b.....k.6.Y.".`I.-.8)

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\bookmark.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):455
                                        Entropy (8bit):7.042424747937357
                                        Encrypted:false
                                        SSDEEP:12:6v/78/6T/sv7SXmUKQrDUVrDUVrDUUERfexqsLh3:p/6YBUWiiPRmssLh3
                                        MD5:AC44F72D2C7A988BD98D8B803C17269E
                                        SHA1:5BA8D489497C5B9015154C4812C553424E7A8120
                                        SHA-256:DEA30755C1B6F31D91A5A9029EDDD1982B097ACF8A8B1406C8E236A64574A34D
                                        SHA-512:D39A3D7585A4B81165E3925B84EE5A2222C8BF9F3ABB1AD618ED09038A1BB297B6C2FC8C031E45A19F9943F605BBD3B443221764D702DB034D526CF3420BDEF1
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs................yIDATx...Aj.@.....PH.z.Aob.9P7]........p9%A...6q.....w../..T....NM.K....2@X.......,....;.....X ......&...5.@.....hM,.@kb..Z....X ......&...5.@.....hM,.@kb..Z....X ......&...5.@.....hM,.@kb..Z...p...]7^<....w.n..z=^....|nL....h_.0..Z...&.......W.O..i.w....X`.....$.,.0L...d......E...p. ...7...2k...ps!...F.........>.=....}....Y......P..M]d~.u.p.A..S.r..... "......7...>....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\bookmark.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):588
                                        Entropy (8bit):5.488645888225472
                                        Encrypted:false
                                        SSDEEP:12:TMHdoIdSNi/nzVA3/KYf3naXiGEKZx1OpGmDZC98zWHomPQS+2:2dVUNA23Lf3ElEqx1OomDZ/mP7j
                                        MD5:9FBFBD6864433EA664DBE4512FF9A9A6
                                        SHA1:5920AAB616C75E40038E626B0548C529BC55C947
                                        SHA-256:347637DA15F56C9B1B3A925087215F68904DA35768EEA10D8D000A6C53E1D205
                                        SHA-512:B4E356201F14B3597F2FEE5205176A63A572449DDD44C258E360BA339B8D3F5A0D3A4502A56FCDAD951AF38C168E8C72238F087B87C53B01D40BCD9852538B86
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="iso-8859-1"?>. Generator: Adobe Illustrator 19.1.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 40 40" style="enable-background:new 0 0 40 40;" xml:space="preserve">.<g>..<polygon style="fill:#F78F8F;" points="20,31.441 8.5,37.191 8.5,2.5 31.5,2.5 31.5,37.191 ."/>..<g>...<path style="fill:#C74343;" d="M31,3v33.382l-10.553-5.276L20,30.882l-0.447,0.224L9,36.382V3H31 M32,2H8v36l12-6l12,6V2L32,2z"/>..</g>.</g>.</svg>

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\bookmark_add.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1364
                                        Entropy (8bit):7.779704024875446
                                        Encrypted:false
                                        SSDEEP:24:p/6hKcTqJ9+QI3+RXnhvk+6Sjey06Rt6hrXD3zJFxftJ0PaUpkc:p/6hnHR+tntknSj06RtSrzFJJma8
                                        MD5:B489310986A6828F9B9D62131D98FC52
                                        SHA1:567737353B9C823D2909E44456AFAB161C52D3DF
                                        SHA-256:F58B07469ADCBDAFEF16797C66533E90F94F12B94E96E9C2AA1926BD2A1881E8
                                        SHA-512:93053CD022CAF74180E0B0CC4F1FEA0C718157AEFE371DB57F376932ED2C547DD93F2E1BF46FAF7452A8BF72A400AEF6DAE9215C15D40A4C919EEC32F6565220
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs.................IDATx...O.V.......M.7&M.....h.....N*....a..PS.t......ZUM;.R(......RU...o.i..z.sc'.k.8q.....H..?>|..a...q..[.....N.W....'....s....\.>..|..m..D8@..q.r.TM.........m...N.L/...p,...+..F.I...@;...nP.'.....v.....K.|.9.=.(.T..KA%.Q...Wv%.;.>..@..uA.U.......+0.h.f.....{.......2v..R.WCj.....R......d.N...<.m.,..Kg.m.x.."......i.[.~.f...n...[2\[.+..vGuJ.*9....G...I.[.~.......J.bp.}b9...:...5..Q..ak).._..N;...+........z..l.y..Z.+.h)1.....K..<P.h....nv..&...1.P..B.....5U..]ZP,.>p,O.(..$.JU.....]....qr..U..Y.=f..y........M...L..<u.Pa.I.....?...">m.?}.9.3... .g....D.M%..&....p~.....@.6.cE.g.`..O..1@...J...0....y8S..j.y..k..(l1..E.wI0...p..yk'~...6..x.K|.....P.{..U8.n"=.....D..T.....Rn..9h..r.c.7..h.4.p.D...R..G...%y.....h..b.b.....U...da......4..!E..tC....W..~.H'./_..~...;...PI)...d.S.Z._^....C.A.g..$.J.....<|.s+t...X.$.._..(L.....r.Ty.>..u....Z.cf...)....[S.n.~.l.M#...<.j.Q..j..E.n`.fg

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\bookmark_add.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):1082
                                        Entropy (8bit):5.469015753372596
                                        Encrypted:false
                                        SSDEEP:24:2dVuAPLPqEfvzPoPDhUP4omDZ/mP7Wo5hyo6pe7vlYU+YsGQ2wUjURxN:cVuAjPmPDW/m1e5hJ62cYsGvwec
                                        MD5:F273A1CC480055181AC96A7B5CFAA99A
                                        SHA1:71BF75F44063C34873556ABC152C20E9FFB947B1
                                        SHA-256:08145AC69FA8B8142FD72954944EEFA873C4F457CE4335898AA66BA6C1E1BF48
                                        SHA-512:EAEBA74E36CD877FD299CF81115B9AB56B2CA521CBBEA62D53CED056AEB2E3CAE1BD5CAD9986A3D3D8BF42B58CC5ED6C3B080B6629C9FE8E3E563382B9B43A7B
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="iso-8859-1"?>. Generator: Adobe Illustrator 25.2.3, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px".. y="0px" viewBox="0 0 40 40" xml:space="preserve">.<g id="Layer_10">.</g>.<g id="fluent_1_">.</g>.<g id="color">.</g>.<g id="office">..<path style="fill:#F78F8F;" d="M20,31.441l-11.5,5.75V2.5h23v34.691L20,31.441z"/>..<path style="fill:#C74343;" d="M31,3v33.382l-10.553-5.276L20,30.882l-0.447,0.224L9,36.382V3H31 M32,2H8v36l12-6l12,6V2L32,2z"/>..<path style="fill:#BAE0BD;" d="M31,26.5c-4.687,0-8.5-3.813-8.5-8.5s3.813-8.5,8.5-8.5s8.5,3.813,8.5,8.5S35.687,26.5,31,26.5z"/>..<path style="fill:#5E9C76;" d="M31,10c4.411,0,8,3.589,8,8s-3.589,8-8,8s-8-3.589-8-8S26.589,10,31,10 M31,9c-4.971,0-9,4.029-9,9...s4.029,9,9,9s9-4.029,9-9S35.971,9,31,9L31,9z"/>..<polygon style="fill:#FFFFFF;" points="32,23 30,23 30,19 26,19 26,17 30,17 30,13 32,

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\bookmark_remove.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1352
                                        Entropy (8bit):7.765380971209657
                                        Encrypted:false
                                        SSDEEP:24:p/6qrMGofunXbdmyDEW3qM8S0SmgC+K3FVaDzSjOAhb0Av0:p/6qruGnIwEW3qqCH3faDzSjvpN0
                                        MD5:32B1AF7331614E239777D9E89F2A8202
                                        SHA1:36F63C393E9540982A4DA4A9764A1662FD9F7BA1
                                        SHA-256:2A741F72CCE7FBFA3F4017CC79729EA21E4066F963645D0C669D21AC79251D4A
                                        SHA-512:31BB88F613B21CE55C26A72AF2D7D5BDB0A6A723ADEFA2BE9F77B0A0FD54C16FD63EFA7BEF050297CA23D8AE2B2DA85B1EE2126DC67994AC620631E43416E207
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs.................IDATx...k[e......^....i..7...7.dMo.5...U:..&.za......X0mt..:.du._.......s./.....v.<.7..m&.<..}...i~<....{...#L.0a.mZW........ .....\..... ".#....M......4... S.D...LM...n..T.V.b..?....0....H....fC.d...9E..S.p6...R\...:......;...-y6,}...-....J..'F.x....G.A5......VJ.q.<<.f....R.....#...)..*.7v..{g'.:r..`a.......i....r|...(..oo.T...`.EW..;.$../xv..~.:..+SM.......a.Y&..?.._v%...I(....v.6.R....7.S.i...n.D.!@.V.N....9j.,./.D>..w.....U3.a.......9E.r..?......Ku.>k;7rb.$q..:.*x`.....OXQx..N...D.lI.......J.....+...r..Ya....<....S.....R.F..H....s..CY.8?..U....."..<.4<.+.}.6.q.p9~.,..WV....m<....)..1.. .z.,......~...W.<..i...........,D.d.()X......>..w..y..Uq....e'..T.VHW......~.t.K.H.])W...h....u...@..L....fBV.....+.kg.."pz...N.C....sd.H.=.6T'..Z.....S..O..r........../..._........<.C..#....|p...x..s...|.C.4......`..X....Xs..kJ.j.il..c..YJR.wgq.>.9....UxN.hA..6..pz..nM......0.hD.ko.0l.y..D....fkej."..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\bookmark_remove.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):1032
                                        Entropy (8bit):5.50128040726307
                                        Encrypted:false
                                        SSDEEP:24:2dVuAPLPqEfvzPoPDhUP4omDZ/mP7WoihyoY7vlYU+YsjW2xN:cVuAjPmPDW/m1eihJGcYsjR
                                        MD5:81CCA7B403F86BB43C974B81CCF04E17
                                        SHA1:366177CC215334772D3EC9A4D0874201A168EAA9
                                        SHA-256:0ECBC4A4F205C098C33C22FB3C66BB99D93B3E47FE06D03FB191234816B9B267
                                        SHA-512:AFB81C0C6639AB502B128AF4528D9F4E80F8C7ABD82E99CEFF6959B79092E8013C8C66B04433FFEBE83745443AA68D8C695B912B80EB02ED05BF64532E877983
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="iso-8859-1"?>. Generator: Adobe Illustrator 25.2.3, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px".. y="0px" viewBox="0 0 40 40" xml:space="preserve">.<g id="Layer_10">.</g>.<g id="fluent_1_">.</g>.<g id="color">.</g>.<g id="office">..<path style="fill:#F78F8F;" d="M20,31.441l-11.5,5.75V2.5h23v34.691L20,31.441z"/>..<path style="fill:#C74343;" d="M31,3v33.382l-10.553-5.276L20,30.882l-0.447,0.224L9,36.382V3H31 M32,2H8v36l12-6l12,6V2L32,2z"/>..<path style="fill:#FFC49C;" d="M31,26.5c-4.687,0-8.5-3.813-8.5-8.5s3.813-8.5,8.5-8.5s8.5,3.813,8.5,8.5S35.687,26.5,31,26.5z"/>..<path style="fill:#A16A4A;" d="M31,10c4.411,0,8,3.589,8,8s-3.589,8-8,8s-8-3.589-8-8S26.589,10,31,10 M31,9c-4.971,0-9,4.029-9,9...s4.029,9,9,9s9-4.029,9-9S35.971,9,31,9L31,9z"/>..<rect x="26" y="17" style="fill:#FFFFFF;" width="10" height="2"/>.</g>.<g id="ios">.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\bug.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3075
                                        Entropy (8bit):7.904263151460043
                                        Encrypted:false
                                        SSDEEP:48:W/6N1ubZjol2GL5f+aWj8ikmCxKFy+BSefUupxRmNHxie1XV+f4GQq2YMnz+JEfh:WSMZK31jWpDyupxAxxV+Q7nzXfyU
                                        MD5:58D5B993E5E1A07C5DAD4000C8190628
                                        SHA1:63CF5C244D9FC9AA532512DA0D3011382ABBB372
                                        SHA-256:BBE2B982ABF71264A15B456643A73F165C28077F829E0855BE2CB314CB6344AA
                                        SHA-512:3D0543B944CA107953B00112CA511780F13045D369A2B698445BB4E6B610502908FD437FC387B79BDA43D3D21B369B20C682CFEBFEB457877F32F3796293ECEB
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....pHYs.................IDATx..]..]E.>U(V..JQQ...@YT..@ .D.@L..(.H.P..4b.A.......E.(K...E.d.US....Q.RP.........o..gf.{o..KH..o..w.......................3..0Oa^....n....k...\[..#...0/d.c......5(..f.9.s..R..5.s...gQ.)^..f.}...L.=...}.K..s.....U-.aK..T9>u.K\.....#......(.CK..g)s.(..!L...[.F..X].I..j.YGQ5Z..V.).pK'.+vd.F..,..`.d.!.._.jdm..uTM.0.0.2.f..|.s...[...k.7s..,..Xg.k=.4.......e..l..F..7."Z~w'.e.\....<.6.8p............P..K...(..ZC...0...(..N...{).i.G2_.Zx...Z0M...:...&..\8......g.^..3.WPXd.......'..S.....]....B.b..\...7..&.}*0..3.X#.N.ak...f....0a9...OR5...%X. .f...|p..A...W._..G.2......|q..p'@..4...7..;n.....p~.....V[..{...d.&..>.Gf8N ...Vydf.>s?!...cyd...|.T..T...*P.[I..<0.L=.L..^S.k....) $~%.|.`Qg#...6......6....H...v.C.o....Sy.1U......Ic_ .I...7D.7..5L...|..u......j..K...j..........].j.wh..M...K~...3K.hP.z>.z.m..6}~...Y....yq.eZt.X......`F....'....I%..."..]}~...!....Y.N.(.ZI.]..w..h.E_.....4.I..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\camera_dark.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):687
                                        Entropy (8bit):7.514196356494635
                                        Encrypted:false
                                        SSDEEP:12:6v/77KTJvSkHqgbo6pj2iA3+pjOLqWfro1MNzPPIey6eEg1HMtYInhhUdEpRrVx4:uZkfooqiAOEZo16yLEg1NW48RZEN
                                        MD5:87CE8A3CCB880A6EE050C820EDB75068
                                        SHA1:88A3D07B23A5A8CADF3CEE46E78C7EC9A61EF41D
                                        SHA-256:341FD5486720DF63EFEAD45A90EC8A9353CEA9ED09EF5508E073F0428D93A708
                                        SHA-512:C02FC968499B7C47092C6D59FEA7AA4CC812B8A75CECA831D3FC2358043EF95232592AA35E3DA1E3CDEF3D9DA3B4F2EC1613411C9931C2E9C71BF3EA24B153DB
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....bKGD..............pHYs................tIME......+t4.....<IDATx..Z].. ..X.g..5.P._.VE..K..N.'..`0...U8.x.3..3s..p....{.....Y.DD!....8b.^.1.^..v.A.{...........=!...w./.#..H......f......Hx.b4..........pG..{f..W}..R..!....wJ.[...nS@.2s......kK..k.....&.....3FDQ;...R...s...r.\..{.!sK.cJ>.H|z_.H.vl....3.yoY...<.=.V...8...R@.X...6s.M.B_.5..g...M.:... r.*..u.=~_..%G/....o...I..s.<;w.1...;..hJU+....&.[+.Wh..0.".w..".......J.*E.db+.1...b..M..fZ..rg.jEP...O...a.YM......@.........@*|JVc.@..c.>.B..J\/D.....A.Cu..J....>...6..,@K..m-Q...z..C...t.RG...r.I.8.N.P.wxt9<.......A......c$#D.."....j...{.vl.......`0......Qr.,........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\camera_white.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1304
                                        Entropy (8bit):7.73373936021494
                                        Encrypted:false
                                        SSDEEP:24:LKMHZVaoiN+HxWIHcVIFZ5EcOi2xFoJkIB8fQcI70LVHFX1uvXRA2aE8/at33c:LKMrao8IHBrDOrx0lPAJHV1uvBA9E8/r
                                        MD5:EB23A09A738F035E563EF333654A4B31
                                        SHA1:A8964E27694D3FFF799B752EC18C83558118A08E
                                        SHA-256:2454278F24E89C9B8E7602A1422F1E7CE9542A5D6BBFA8550E1F281C0680807F
                                        SHA-512:29DD5EC709D7B0479605C59B53F8D16081BDFD754D75FF5A1CDBD67AB7FDB44E02730975F3ED1907E67EFA3E377D853BDA8594140AEFFBC940B3D4DD5DCBB5EA
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....bKGD.......C......pHYs................tIME.....4 .q".....IDATx..K..U...S..3#..(.$.ua0.A$._..n...KEw....Y.ti@0Y...T.3...F.T4Y..1...83.S...S..~..z........S..s/4h.A...!.Up-.d.fV>...G.........x..O.l.(...1.K.7...73..,*.... ..r<$).E..q]d....l...`...[sKR...gQ..t'.*..p....%|...Uv...2...........I...y.3 .....X{...O..y.Y.I. ......w...o.,r.W..^.~GFI.f.H.I..0W3s..\...9....&."..{~...s.D..&.t..s?..|.|.\.........3.K.....a..XB......tZ..x...&).....yI.......Ss... ......C..JZk..._...)..k..f....1......Jz...n....X.j..N...@..t.f...-.v!rm.lQ..X7.nE.1.^6......Jj...P~w=....=.T....^I...m.Kz.......h..z..N.w..........@X.J..8....#.....1l....<.._....y.X.t_.l... ....`g....~...S....;@.s.^...z.Z..g).K...r.u.Tf.S........../y$....GI.w.B...I"....cA....~..x.~..i..j....N....C.A.8kfi.y.....T@.|..L,....o.`1O.<.~^...j.fv..u...T..Q..u..L+E..].3Sp....p gI...S.........h.MtR.%W....z(@..1..xiO...b..Q`...H.gs..1.+cV.Y......O..i...f..1..y.8M

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\chevron-right.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1044
                                        Entropy (8bit):7.628204010871327
                                        Encrypted:false
                                        SSDEEP:24:C/6StB5M1MeKxwTdebhEtSHqyz4hjjhdO8ebivZ3dq:C/6Sb5M2eKxwTdedEgF2QZe1dq
                                        MD5:E1FCB8FA7C8B646F58B7081A9242C813
                                        SHA1:3DFDD33480CFCCCBB61A35DAD17D2977A8EB2651
                                        SHA-256:A714C0CB5D434E4ADCA773815FFF60A37E8204008B698C2CAA805AEAB2E46415
                                        SHA-512:9E0F9650EFC1F85CA7A6741B84406D0148024B4BB5FE0553A13A1DD0B88A064563580D6EBC77EDC372963127FE1B40D24BE11C5597FCB68464A98EDEA32BBE80
                                        Malicious:false
                                        Preview:.PNG........IHDR...`...`......w8....pHYs.................IDATx..M.VU....Y....`..A..4m.....@lb..."...D.......KG:Hkb..@.0D/g........O..8...(....W...$.^.........{.}.q..(..(..(...A.EP$.[CP1.....o...b.ZH.Q.:.A.J.AFp...!...{..$)..?.n<!D!...l!..z0.A.....Q....7.A.'.p.Ag.B.B.w..Qb...SB./..2..{. ..n<.....~B.1.Cn*.\M.`..z..b.z...z?q+...n.!D.e...~..8B.B...!x.D.1.......Cx....!..Z..w...7q.;..b.|.A..@N..B.B......M..!.Pw>"...G..`5...he...2..........Q........B.~...!N...s(^.,y.3..T......l....=....!..K.A...Zv...~..*k....E.C.....<k.........h....3@8h.....u....C.}.^.mk.e.8^..7i.....A...a.....^.......;...V.........'.[{-=..A}..kk..;3....v}.^..q....Z:.}.^K..b.u...N."lX....|/.......=r.e.^.eXtO.QD..0.......g.L..^K.$....J.......{,...2...E..U.|./.m..'...k5c..;.}/7..h!...|A.6\..t.._./..*...F/.5U...{...~.p.W.Y|...^w....>L^. C.W..Vo&.W.....x.r1...e1.....3.....dc....b6.U....x.2...^.qt.i....}..@..3,.{X......VB.}.^n%...Q.L3.m..]..#>AWX{m...f....}.R.....)C.p%..[.(?...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\clock1.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):7607
                                        Entropy (8bit):7.831394572490859
                                        Encrypted:false
                                        SSDEEP:192:DW4dCKlspppp6L6U0IqcE9ep1cX+qXboPgKJztFyuoaFKcKjfS:aWCKcprge9ep6LXMJptFNfMfDS
                                        MD5:EC485EDE1B8D7CC4A86BF8791E4F5D2A
                                        SHA1:620EAFD5B00E551A3986952A27906BCB0119697B
                                        SHA-256:D24A9CBD7BA52FC55FF1234E137258DC1DFABCB10BD5FE08A0D08E3B617DB346
                                        SHA-512:170B63605F75184B5A20405717CC0F8CF8A7E1670EAB3051E2E877B74E7E2B7AA2FFD409812339A85B2DC4DB112A6156DA9D3C150F91F68FAD391CA9A2378F60
                                        Malicious:false
                                        Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE...................................................................................."..$..)..,.. ..!..".. ..$..'..&..(..*..,..1..7..9..=..! .- .!!!%$#%%%)#"/! )))---0" 2$"6&$0..8(&<+(111633666888===C..D..I..M..Q..V..X..]..A.,C0-E1.J0,G20@>=H30J41L63M74O85Q96S;8V=9X>;a..f..h..j..m..p..u..y..~..B@?Z@<]B>AAAEEEIFEIIILIHNNNRNN_C@QQQTPPVVVYVUYYY^ZZ]]]`D@fHDhJFkLHmMIpOKqPLtRNvTOwTPyUP}XTbbbd``fffhdciiiokjmmmtonpppuuuzuuyyy}}}..............................................[V.\W.^Y.`Z.`[.a\.c^.d^.e`.|{.fa.hb.ic.id.lf.nh.nh.pj.qk.rl.tn.vp.wp.xq.zs.zt.|u.}v..x.........................&..6!............................-..>&.O8.RA._K.eQ.sa..y..{..|..|..~..t.....................................................................................`S/....tRNS...................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\clock2.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):8512
                                        Entropy (8bit):7.85639057571749
                                        Encrypted:false
                                        SSDEEP:192:Oswc9zY7L3k9gwwvsQDEfoZeIW8vs7/iIIEKEP+8p:Uc9WLU1wvs9oIBVQEP+8p
                                        MD5:D957119A80CF635B49D20CF56F4E1065
                                        SHA1:A70F47466330F4B39968723B02FD0170CE92E665
                                        SHA-256:FCFCB13DBC166EC8FA671C3D2BDCF365CC8634AA63B94CF69BBB6EEEDE7B0BCD
                                        SHA-512:35285A9855E726C69CEFE80CDB03FD4901A66150989DCF0FADBF51D1EFC904C3EFF2DBB4F657096DB8844AF38D0D3E3E3EDC8DFB43A92711BE8E57153388FB94
                                        Malicious:false
                                        Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE..................................................................................................."..%..(..+..-..!..#.. ..%..1..4..7..9..<..! .( .*!.,#.-$.!!!&%%/& ))),,,0& 2("5*$7,%8-&;/(=1)111666888===A..E..H..K..M..Q..V .X!.\"._$.B4,E7.F8/G90H90K<2L<3N>4`$.f&.h'.j(.l).p*.u,.y-.~/..0.Q@6SB8TC8VD9XF;YG<ZH<]J>AAAEEEIIINNN_L@QQQUUUYYY]]]`L@fQDhSFjTGkUHmVIoXJpYKrZLu]Nw_Px_Py`Q}cT~dTbbbfffiiimmmpppuuuxxxzzz}}}.0..2..3..4..5..6..8..9..;..<..=..>..?..@..A..B..D..D..F..G..H..fV.hX.iY.l[.m\.o^.p^.r`.r`.tb.vc.vd.xe.yf.{h.}i..k.I..J..L..M..O..P..P..Z..R..S..T..U..V..X..Y..[..\..\..^.._..`..l..x&..l..n..o..f..p..q..r..s..t..v..v..x..x..y..{..|..|..~..8.X..K..c......................................................................O......tRNS...................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\clock3.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):7229
                                        Entropy (8bit):7.785150298696893
                                        Encrypted:false
                                        SSDEEP:96:1aMFUMGlDs8zLR0tOaJHyzDK2VFHzY4MpeXjxH+NXtKSYANS9jSBDanhBUd:1b2MGlDsGLR0tMDj1CsxIthk/ed
                                        MD5:D98936082F2FE74CEC8ADC729DAE1FB6
                                        SHA1:82B03877AE7E92E88B94359CF02AE6F9D3058C83
                                        SHA-256:8E8EAD8B910B4528A6AC8C4CD8D7604432D7CE51FD166B79FB4A19816866180A
                                        SHA-512:7936AAEEAA21AC5FCDD4C59A23768582B7A272259632921B14FD389A5C68447E11EAEFF009F2D410296B860870D5DC430CA96B4CCB0AE321F3711E55852E7FA6
                                        Malicious:false
                                        Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE......................................................................................................... .."..%.. .. ..' .)!.,$." .%".'$.(%.*'.+(.,)./,.0'.2).4+.6,.8..<1.!!!&&%)(&)))--,0- 41"11.95%=9(111773665;:7999>=:===B6.E9.H;.I<.L?.A=+M@.PB.RD.VG.\K.D@-AA=JE1MH3NI4PK5QL6TO8VP9XR:ZT<\V=_Y?`O.aP.fT.hV.jX.lY.o\.q].t`.xc.yd.~h.AAAFEAEEEIIGIIIMLINNNTSNQQQUUUZZUYYY^^^a[@g`DibFleHohJdb\piJrkLunNwpO~vSbbbffcfffhhenleiiimmmpngpppttquuuzytyyy}}}.j..l..n..p..t..w..y..{..|..~..yV.}X............................................[..\..^..`..b..e..f..h..i..j..m..p..q..r..t..t..u..w..x..z..z..|..|..}.......................................................................................................................................Z\.....tRNS...................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\clock4.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):7522
                                        Entropy (8bit):7.81127387729523
                                        Encrypted:false
                                        SSDEEP:192:jsw06+k8CmaUTBvA+j8eOf6PxPMkguT6EKp:C/FRFj8uPMk7T6d
                                        MD5:F4FA836357AEF23E14DA4AC2298BA63F
                                        SHA1:1EFBCBEBB328200BFFB856090BFE67C8FE5DA504
                                        SHA-256:3819F45A09E2016EA873216BCB9BCFF4BF581FCF6740B7E2ECF0CD0723BFA628
                                        SHA-512:4EC5EE28988B2A66DE20A6CDF805408C92BCB06421A1AAD91F972B0B3FC6CA582604C97985C463CE29D5DAA7F6D34B9BEDE4FB44FA11C2F9A8B6D800F644EF0C
                                        Malicious:false
                                        Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE.................................................................................................... .."..$.. . %."(.$*.&,.(/. "."$.$&.&(.)-.(*.*-.,/.)0.,3.-5.19.4<.!!!&&&))),,,.1 03"14"47$58%8;'9<(111666888===7@.9B.:D.<F.>H.;B.=A+@J.BM.DO.EQ.JV.LX.Q^.@D-DH0HL2JN4LP5PT8RX4SX:TY;UZ<W\=Z_?S`.Xf.Zi.\k.]l.`o.aq.dt.hy.k|.m~.AAAEEEIIINNNQQQUUUYYY]]]\a@bgDchEflHhnIjpJouNpvNrxPtzQv|Rx~Tbbbfffiiimmmpppuuuyyy}}}n..q..r..t..v..x..z..~..z.V|.W~.X..................................................Z..[..\..\..^.._..`..b..c..d..f..i..j..l..n..p..r..s..t..u..v..x..y..z..{..|..}..~............................................................................................#..F..^............................................................................u'E1....tRNS...................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\clock5.pdn

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Paint.NET image data
                                        Category:dropped
                                        Size (bytes):40479
                                        Entropy (8bit):7.479786333974441
                                        Encrypted:false
                                        SSDEEP:768:pPjUB/mEJUGImzqgyKHjVvrJYG04NBmZaIgnFk2SHM3cAwA54KH3333DOd:+XpFzqgDVvrPXmzN/IcDwE
                                        MD5:936FBAC7C0125C83CE95F6771890DCED
                                        SHA1:2FB70236A591EBA04C4A13CCF18886BD3BD94468
                                        SHA-256:E7D7FBFFCA2E88099B3F92093137742F382D902FF5382940193CC0C8FF0A8729
                                        SHA-512:43D1C95397B230601A8166964232025ACCD2935F24607EA1E92F447A68C1DB39F622E567D72F633154A9ECC5487E0DCFB0AD88429A399312958722D65C2C8566
                                        Malicious:false
                                        Preview:PDN3.:.<pdnImage width="256" height="256" layers="8" savedWithVersion="4.100.6822.38824"><custom><thumb png="iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAACshSURBVHhe7Z0J3E1V98c3HvM8kyHzFJEUld4KlYSQf2VooEmaEA1UvIZIiMxD4UmhwVBSSmVqIDJPSRJvRKI019v6r9899/He5551p+e5wzn3rt/n8/3Up845z9377L3P3muvtbZRqVQqlUqlUqlUKpVKpVKpVCqVSqVSqVQqlUqlUqlUKpVKpVKpVCqVSqVSqVQqlUqlUqlUKpVKpVKpVCqVSqVSqVQqlUqlUqlUKpVKpVJFoJxMHqYAU4Qpy9RnWjFdmX7MSOY5ZjrzArOAWcIs9v7788w0ZgIzgunD4N6WTD2mNINn52dyM/ibKpUqAcrF1GG6MMOYdGYls5M5wfzDUJT5L3OM2cq8w8xhhjI3MtWZHIxKpYqy8jHNmPuYmcx65mdG6qSJ5CSzhpnE3MWcz+RlVCpVBML0vQ0zhPmQ+ZWJxRc91uA3/8K8zwxksBwpzqhUKh/hC4+v5f0MvqDo8JhuS53KzfzNYObyNnM7cy6jMwRVSqow05QZxRxifmOkTpOsYHaAge4gM5xpzMC4qFIlrdDA0dDHMV8xsev0OQzlyZtGhYvkp1Kli1CFSiWpWo1yVLtuBapzTkWq16AyNWhUhRo2rkrnNDZUt5GhWvUN1TzHULU6hipXN1SuoqESpQ0VKoJnCX8jumAw2Ms8yWDHATsaKpXrBcs4ts96MpsYNHSpA0RMzlw5PR28bPliVKvOWdSmfRPq83B7mjq7N61YO5Q+2foMfb53PO38ejLtPzqDDp+aQ0d/Tqfjv82j739

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\clock5.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):10074
                                        Entropy (8bit):7.879043925395544
                                        Encrypted:false
                                        SSDEEP:192:y7rsWYYYYWyAdow9w527mWGZiFXqlmIRJRFJwOZHTrra2pow7E5+20CSwAO49nYh:udYYYYhAdXw527fGZY6FRl1+GX7UJ0Pk
                                        MD5:A4B58F558D7EC991FA56D9198695295C
                                        SHA1:2A27A86928564014E22038FF5286FD5D3C7803C2
                                        SHA-256:E59B42DABAB1D50CCB440460BF4847C28DE23249F5B6901FD7DA26A4CF51EAA4
                                        SHA-512:4473CFD4E32C840523DA30E5CDB466E85A5E703BEEB29A2B1BF406173A5ED5220E4D2CA3D5F24678BD79B2DEE37CCDF9FDFA671C0D34A798617D4963E0E3CEA0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE......................................................................................................................"..%..#..'..&..!..%..)..)..,..)..(..!..#..$..0..1..5..8..2..:..9..<. (.!*.#,.$-.!!!&&&(((***,,,&0 (2!)4",7$-9&111666888===.B..C..E..I..L.!K. M."L.!Q.#P.#U.$W.$Y.&].3@*6D-9H0=L2>N4'`.(a.*f.+h.,j.,m..q.0u.1y.3|.4~.7z.@P5CT8DU8FX:I[<I\=L_?@@@BBBEEEIIIMMMNNNPPPRRRUUUVVVYYY\\\^^^NbAPdBTiFXnIZpJ^vNayPe~T```bbbdddfffiiilllnnnpppuuuxxxzzz|||~~~5..6..8..8..:..;..<..=..?..@..A..B..D..F..G..H..I..J..L..L..N..]..i.Wk.Yl.Zn.[n.\q.^w.cx.d{.f|.g..iO..P..Q..S..T..V..X..Y..[..\..]..^..`..`..b..c..d..e..g..h..i..t..~.#..l..n..p..q..r..t..t..u..z..z..{..|..}..~..5..F..]..q...................................................................;....tRNS...................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\closebutton.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 43, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3521
                                        Entropy (8bit):7.9323910528379065
                                        Encrypted:false
                                        SSDEEP:96:S6MC1mfxQGFRS5VXbT/yeTaDLrDhSU8vK5:SaomgRSfbTdefrdZS6
                                        MD5:07EEB16ED0040531D2568CF359468D91
                                        SHA1:69BA21DE53159D068389A698D9BEEAEE8FA87D2F
                                        SHA-256:0E6FC1B67FCFEA30ADE09EFEC461E9CE1A3A2EF99683FB83BC3B2D2A9442B50B
                                        SHA-512:1975BF10DAAFAAB18430359C0C301AAB274A4E7D20605A7BA6FAA83AC2B2185E336EB78B421A6DA9700D19661072028EC1973CB6E7685C4A04D881FF609125B7
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...+.....$/.Q...AiCCPICC Profile..H...wTS....7..." %..z. .;H..Q.I.P...&vD.F..)VdT..G."cE....b....P..QDE..k..5....Y.....g.}..P....tX..4.X....\..........X...ff.G.D....=...H.....d..,.P&s...."7C$...E.6<~&....S...2.....)2.12....."..l...+...&..Y...4...P.%...\.%.g.|.e.TI....(....L.0.._..&.l.2E.........9.r...9h..x.g...Ib...i...f..S.b1+..M.xL.....0...o.E.%Ym.h.....Y..h.....~S.=.z.U.&..A..Y.l./....$Z.....U..m.@..O. .........l^....'....ls..k.+.7...o..9.....V;..?.#I.3eE..KD......d......9i...,......UQ....h..<.X..d.......6'..~.k.hu_.}.9P.I..o=.C#.$n?z.}.[.1...h...s.2z.....\.n.LA"S....dr%.,...l.....t..4..0.,`...3p.. ...H.....H.i@..A>...A1..v.jp..z..N.6p.\.W..p...G@...K0..i......A......B...Z.yCAP8...C....@..&..*...CP=.#t...]..... 4...}.....a......;..G...Dx.......J..>........,._..@....FX...DB.X$..!k."...E.......H.q.....a......Y..bVa.bJ0.c.VL..6f.3....b..X'.?v.6...-.V`.`[.....a.;.......p~..\2n5...........&.x.*.....s.b|!.........'..Z.k..!. $l$T

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\cloud_no.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 344 x 344, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):14573
                                        Entropy (8bit):7.920266929168651
                                        Encrypted:false
                                        SSDEEP:384:UiH7JdrGAPcFuLFpNQ/PfN7Tr/SLNdfc9GOVXyTO:PHddr1JFpNkHJTrq5ux8TO
                                        MD5:91A7EC74C96AB0C177AD6775BDF07E93
                                        SHA1:72E6C153AA571AA7DEABDB2CD52E46C98CEAFFAE
                                        SHA-256:9FBFCF114A0AE26F486AA31D1647F21F291760C322A3805037D48FC6B904A388
                                        SHA-512:D367A3AE76ADC3304643F687930325D15EC40905405219270CD14E516476F1FE612549055354F3E4587B3A19C51F8B108AB11D8940F493B8A74665128B11FC4B
                                        Malicious:false
                                        Preview:.PNG........IHDR...X...X......l.@....bKGD............ .IDATx..y.\U....Vw'......HB6....2.#.2/...a.@......Pv.@6!..1..:...2. 8. `......tw.......v-w9.{o.{.>..G?.....r.N..U.0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0... .....?<...?...3.O.y...Q.a........{. ..@..M..E.?MZ..-Q.a.....v..CN.9z..5ew.5......7E21.a..D*X....d..I,..VA.&,Y.a.I$.. W..,.0......K.a.DQQ.....K.a..P1.. W..,.0.."..P.&,Y.ab..v..3.9. Z..\.`n&C.?.....d....PW..\......d...-..`.m.....s3.......{0..h........d...w....Y..c.........`k2..P1....?.=..J.a.8.....u.R.)K.a.X..`.3.O..?.Q...,.0.!.....<h.0.<....z..W.0..9.^..e.&..I..,.0i."..e.2..F*.e/,Y.a.FE...%.0L....n.d..I...d.K.a.4....d...v"..n.,.0.L...X...T/...`.2.S..B..K..9x%5..o..S.....AP3...9j....:A.....lN..... ...r9.>....6!..Bv.P.9W.-{Oi...c.p..O.q"6..X.I$/.]..24O..'.....`&..A. ..b;..fAx...%rx..x..[..V.~..`...J..K6.....s....a.>..C.0..L.........!.K..7........!..;..,..e.MCc.@.. ...8......@...f....Ea..o...N.Y.4.(.K..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\cloud_yes.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 344 x 344, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):8329
                                        Entropy (8bit):7.763067899763679
                                        Encrypted:false
                                        SSDEEP:192:HS9co0ZDo46eSNj0IzZMF5InvbJeZhZpCc2gBUBPb+YbUFsb8:yuozeSNQ0ZMAjJeZhTCHgeYYbY
                                        MD5:8477160CC0DE301D338DF75CA1F09CE7
                                        SHA1:F8DB6074FF1A4B8FDFE687DA6579E1570C4CB6D2
                                        SHA-256:E6E57571718E100EC906099C2FDEE135A25A5B7D4AD7B263D848C26C55E6D456
                                        SHA-512:EBF44772AD1D8EDDC3699339E97FA32DE998B0FBBEAE6CC81EF93521BCFD8EC8FB76B9D61FB29BFB304B02B3C98CBB4BAF96CDC626F4CD7652DF9426B15C67E1
                                        Malicious:false
                                        Preview:.PNG........IHDR...X...X......l.@....pHYs............... .IDATx..o..y._...^.)..I...*u......E.8m.]l.4q....h.m.8.$...[$E."e......m.I.x.m..&u.4.l..i..CR.x.o...Y.C..I.......x..................................................................................................................................................V..]....`QaS....g.......c....Bg.eks..Y..o.6..,t.......i....)...4..U..h-l.7.6.j.......V...t^..#V.v>Y.^..$..N.V....B.ls...\.V.3.9..:..Na.|.x..4.F...&...1......._.7.?aqz......`i2m.....z.6.@.._..;6W(ls.'f9R..X.0y..P^.........39.o6....P~.....|...UZ...Y].[....y..._p..}.y....k.}-.).5..?7..)E...\..VW....*.X.....Bcq.F-.....s{.n.....V...^ou.x...9.....B.S.y...w.......=hi.>...,...:[.ONH...]\.+...r.T.S.{p~nq..._?..?3....3PX..:\...Z.T.-.jb.....x..:|?.8.......g.`r.k..l-7.....AQ.R..Xg.u.........................%.gf.><...X.6...[9..g...?..:...6.>X.....%xKV.._.r.uB....NLN..'..-.m....w..Q..y...Pk.+xO......c..r..rD..8VW...w.....r..X.....;.......'...l..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\coldcard.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5283
                                        Entropy (8bit):7.742906001757597
                                        Encrypted:false
                                        SSDEEP:96:jknmWIC4/VHmbJX/D6AWaSaBv3LItxj3gBgvEm5DmFR:jkn6YJmAMaBv38zj1vEXR
                                        MD5:B999C41086083E5F35D8464CB88384FF
                                        SHA1:3F0CBE3D67A92081CB81DCDA546898743B5A48C9
                                        SHA-256:E2935A7BBFA30974E65D79394BD3D01EECD741951EB3185A1F4CE9BABE62716C
                                        SHA-512:4AC7B5CF61ADC065521E9D0F9CD0BA34B6D8B231433B79D83963262679E3C81E922A81831CEB9D9930E9A73487E9EA34EB8A681AA93A29A47D2A6CE58A98F1B0
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs...#...#.x.?v....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)" xmp:CreateDate="2022-03-11T10:05:35-05:00" xmp:ModifyDate="2022-03-11T10:12:17-05:00" xmp:MetadataDate="2022-03-11T10:12:17-05:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:9179abb6-f3c0-4893-b300-e3eec0c120c6" xmpMM:DocumentID="xmp.did:9179abb6-f3c0-4893-b300-e3eec0c120c6" xmpMM:Origin

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\coldcard.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):2652
                                        Entropy (8bit):4.974927453525817
                                        Encrypted:false
                                        SSDEEP:48:020lSdlkdlEYvYdWQYoNEXWhjuX7qgN/4QSwhj8hzhZo7tJZJN:isdlkdl6WSjJ0qgNr3N
                                        MD5:4CD7B06B074D75A052B128B1EAE6AE35
                                        SHA1:B817362DCA6C89ECD8C9601C90B95CB8740633B2
                                        SHA-256:7473EB6E4C90EDC6B9D3FA5D15C6D7B4CE65268C5C7838E5BA6E16A1CE981171
                                        SHA-512:CD3A3E01FA538ACE4EE3647FB37AFEE63D4F3DFBE91C67B0CDADE55E8DC47FBB731F6345662406736825E32295D95BE784268FFF07A7EEF1A4A953A55FA2D13C
                                        Malicious:false
                                        Preview:<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 80 80"><defs><style>.cls-1,.cls-2{fill:#fff;}.cls-2,.cls-3{fill-rule:evenodd;}.cls-4{fill:#ff0032;}.cls-5{fill:#00d30d;}</style></defs><path d="M16.66,78.7a4.28,4.28,0,0,1-4.28-4.28V5.64a4.28,4.28,0,0,1,4.28-4.28H54a4.29,4.29,0,0,1,4.29,4.28V74.42A4.29,4.29,0,0,1,54,78.7Z"/><path class="cls-1" d="M54,1.36a4.29,4.29,0,0,1,4.29,4.28V74.42A4.29,4.29,0,0,1,54,78.7H16.66a4.28,4.28,0,0,1-4.28-4.28V5.64a4.28,4.28,0,0,1,4.28-4.28H54m0-.89H16.66a5.18,5.18,0,0,0-5.17,5.17V74.42a5.18,5.18,0,0,0,5.17,5.18H54a5.18,5.18,0,0,0,5.18-5.18V5.64A5.18,5.18,0,0,0,54,.47Z"/><path class="cls-1" d="M54,0H16.66a5.62,5.62,0,0,0-5.61,5.61V74.39A5.61,5.61,0,0,0,16.66,80H54a5.61,5.61,0,0,0,5.61-5.61V5.64A5.63,5.63,0,0,0,54,0ZM16.66,2.72H54v0a2.93,2.93,0,0,1,2.93,2.92V74.39A2.93,2.93,0,0,1,54,77.31H16.66a2.92,2.92,0,0,1-2.92-2.92V5.64A2.92,2.92,0,0,1,16.66,2.72Z"/><rect class="cls-1" x="16.89" y="7.91" width="36.84" height="66.51"

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\coldcard_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5242
                                        Entropy (8bit):7.753235998143419
                                        Encrypted:false
                                        SSDEEP:96:jknmWICZ/ODmFEHmGGdyw0uvnSX2PNdbKYLSoDOBmhDZJ0KobbT:jknuZ2yqaX6Gg20Dj0NbbT
                                        MD5:6A45E384D7D681397143F4F3FC978EB0
                                        SHA1:AE66424F180643900EA63948A6CC554D24D877AF
                                        SHA-256:2BC126C7DBBE256D45E5890DCE1FE9F2C98E2F29520DE8296ED06299497BA408
                                        SHA-512:211D7A8E354B9A1A75CFE01BC795B838E6F019FB5702AEE00DF280DC4669F0341309BD4C031D06303EC29A641F2BDFD36C4881EC489ED88FCE8F53AAB74D40EE
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs...#...#.x.?v....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)" xmp:CreateDate="2022-03-11T10:05:54-05:00" xmp:ModifyDate="2022-03-11T10:12:28-05:00" xmp:MetadataDate="2022-03-11T10:12:28-05:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:f317a6c8-5482-4a1c-8b72-7d8f79a2414a" xmpMM:DocumentID="xmp.did:f317a6c8-5482-4a1c-8b72-7d8f79a2414a" xmpMM:Origin

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\coldcard_unpaired.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):3566
                                        Entropy (8bit):5.208716809158055
                                        Encrypted:false
                                        SSDEEP:48:cDAvf3HJK5Cx15vbZQ/xp8T5XtmE3XXjLlkoqhL0QjpBeuY8d+3uJfR2:nvfd3ZQ/xSOayoqhoQf9td+3GfR2
                                        MD5:3D1871F9FD1BF9D1F5994F76F0DDA54C
                                        SHA1:1944054008D8C6F9F17C17E72EA41383F403904B
                                        SHA-256:6C189E6791B02AE1029D274024EAA087126D97989B2BAC3FF095A121A715B55B
                                        SHA-512:8DCF4B94C25E6AA3DA1C9CADD8860D26B4F3B2F6D3DA68D0352D91278C05B6F4F87D7EDEA8C7CF2FA9D87AC8387F6F33C2DFA8D94F2051A483739036B10EEE7E
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 24.3.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 80 80" enable-background="new 0 0 80 80" xml:space="preserve">.<g>..<g>...<g>....<path d="M16.66,78.7c-2.36,0-4.28-1.92-4.28-4.28V5.64c0-2.36,1.92-4.28,4.28-4.28h37.3c2.36,0,4.28,1.92,4.28,4.28v68.78.....c0,2.36-1.92,4.28-4.28,4.28H16.66z"/>....<path fill="#FFFFFF" d="M53.96,1.36c2.36,0,4.28,1.92,4.28,4.28v68.78c0,2.36-1.92,4.28-4.28,4.28h-37.3.....c-2.36,0-4.28-1.92-4.28-4.28V5.64c0-2.36,1.92-4.28,4.28-4.28H53.96 M53.96,0.47h-37.3c-2.85,0-5.17,2.32-5.17,5.17v68.78.....c0,2.85,2.32,5.17,5.17,5.17h37.3c2.85,0,5.17-2.32,5.17-5.17V5.64C59.14,2.79,56.82,0.47,53.96,0.47L53.96,0.47z"/>...</g>...<path fill="#FFFFFF" d="M53.96,0h-37.3c-3.09,0-5.61,2.52-5.61,5.61v68.78c0,3.09,2.52,5.61,5.61,5.61h37.3....c3.09,0,5.61-2.51,5.6

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\confirmed.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):54212
                                        Entropy (8bit):7.970233760777671
                                        Encrypted:false
                                        SSDEEP:1536:rGahqm2/VbUguDy6As9ShagaUydNCgTNPJAva3gc:rjMf/VmDnAsUkgaFZhv3l
                                        MD5:8C98780B65103F87BA4F098B7899C4D8
                                        SHA1:3F4D4499D9AD2EF94FB50BAA5EF44E83D6C74A85
                                        SHA-256:B360C75FF523EB1EFFBD4E9604985551F164E3EFEC13F36B8C766684469880F1
                                        SHA-512:A0DFC1C1B24C6E5D48BA90CE0EB61531C354CAB31401994B888890855E5EF85A5EDE818465625D1186EF685BA752BDCD66438FC32288E6EA063E5C24055E6CE0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx..w......6g.U.9!. .$r..&.0...9.|...;..>.G..c... r..Q.a...(..6i..t..L....vVR...lw....y...hiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.._`<~.y.n..#........E...a9L...qE..s$+...hiiii...a.....#./a>..aY..v$J.XKKKK...W.<....%..c>.0./a.h..y$I.......v......."...<.?.0.M=..-`---..U......s.]'.G'N..x...=.M?..v......D.!..^.....9..Q.m.>..]..ZZZZG..P..q.g.Y.n......P.g.>`---..I..~..@.........g..p.g.>`---..E..pD...IY(-..2...X.U.>..Q..ZZZZG.~..0...aY,U...@..ZZZZG.n..x.@M.J.s........:.U./.b1..............u......'....6.X....|.~o.vAkiii.i./.Q..7.yCk0bX..x....S..-`---.#I.....+

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\confirmed.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):4153
                                        Entropy (8bit):5.390703146235449
                                        Encrypted:false
                                        SSDEEP:48:cyKzFK4NPG/egTjF6EweHvNeHfNwguH3nlZeZo8LLnLwGCHcGwmsHGs2Ani3klwp:1Kg9zvk03rE4KtBTwsmd5mclm6
                                        MD5:A45C349F80FCF0B030D1583D03A78C67
                                        SHA1:45C4AABF47F6E8F21E43A7F3AAFF7F6DFE9276BC
                                        SHA-256:761C0AC1595E2D15E0261B8D2201FEF930F45BCF5C98340F54D025DB67E1E408
                                        SHA-512:8F8CAA1A6B7D75F30170D86698C2F26E02A3C1D90217130FCF39494952409B3FBEE0868C4A082B08680F203F86B74D5EBE6D64355AD9BABF1F5AD76A9C53686E
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">. https://commons.wikimedia.org/wiki/File:CrystalClearActionApply.svg -->.<svg width="512" height="512" viewBox="0 0 128 128" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.<defs>. <linearGradient id="linearGradient3930">. <stop style="stop-color:#ffffff;stop-opacity:1" offset="0"/>. <stop style="stop-color:#b3d187;stop-opacity:1" offset="0.53316939"/>. <stop style="stop-color:#28f400;stop-opacity:1" offset="1"/>. </linearGradient>. <linearGradient. id="linearGradient3904">. <stop style="stop-color:#4df60b;stop-opacity:1" offset="0"/>. <stop style="stop-color:#008000;stop-opacity:1" offset="1"/>. </linearGradient>. <linearGradient. id="linearGradient3878">. <stop style="stop-color:#79ef39;stop-opacity:1" offset="0"/>. <stop style="stop-col

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\confirmed_bw.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5113
                                        Entropy (8bit):7.936619810260154
                                        Encrypted:false
                                        SSDEEP:96:WxZ9SAxubw9s9UKLQfcA5w9IUwVv7EmJSrnj7ZvmCrlm16j:WxZcA4U9l497wxAmJafZnlm+
                                        MD5:E168A886B7A1ACB98874E398016424C0
                                        SHA1:85247B8FC71D4B079567CABB36ED539421FE2251
                                        SHA-256:DF9C20D1B59FDD66EC7C7D914AB2DCF05C5D7A135FBA1EE5DFB33F723049E08F
                                        SHA-512:BC5A8D661C4083978CF140CDB9523FA64B289D4F720EC3C85CA936CA30DE4F37BE83EC51C407A759C0086C5D054EBF01AA5C403C36AA05E83861F371B70835F8
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....bKGD.......C......pHYs...F...F.2.v.....tIME.......Ni./....IDATx..[}t...=..w.dH...@T"PeE>"V...k.VD.I..Scw...V..Z{...g....n[qUj...*-..Z.Q).&b..QA...!.c&.....>..LB.......y.{.....>.......F%JJB....$..|...:...Q......p...3.:......i.....F?..=///.........V.H...].&..\..?..7....[,.....(.D@...).83`.0........6...h......%7Y[{I..h......%KB...'|q...J...."#.8..N...}?.,.<.w..-..s.....:[.......q\.D....PQ.....V.E..".+4. ..X.....d...d.....I....1..r.H`/0.DH.V...s.M=&......... ..q......XG..g.Qp...g..Lh.M.X.$b,.}..:'G.3qww7)........U)1..V.C.v..{.D.l9eIm.$...X......j3..<.t.[..h........G.4'. i.]..u.....6.F...=6...........p{.#.P.Z.&.J.s. SND9`.=.Aq.....(.YWUU..........a....Ab3..N.0....P...C/..&....G..?S.b1.%........E..@.f..4.}.d..]xa...._..@..lYA...X.P.-..p...$v.+..............*.N_.Tt....".ef....I....>Z[=mwV..7..}....:u..k...=.......B.g&1.....`...X.........:e.....@R.f...^6..Y=}z.@8........_.._....mlA;.U?J.%.....`.....|b.P...!h."{6....%}r.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\copy.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2111
                                        Entropy (8bit):7.875754382663259
                                        Encrypted:false
                                        SSDEEP:48:mglnOTo/lbssCAgsysVdlptoKTl2h5fip6pQzz/xyNRcGt7k:mYeo/lHDZd1to4sXfu6ssHcGtg
                                        MD5:70670904C4B157557987B0F7A24D94A0
                                        SHA1:2F7E04659C6BB6DA6657E56CD1F1BAF1B5883C7C
                                        SHA-256:30155ADE9AD1D64EA9D677BDAE9BEE9E46DF6B945EC27E07B988C0E57D1B243B
                                        SHA-512:EF6ED5F39D6E9741A1EFA8FA9C4AD7CFC26ED3DE056DC44C1E3EFFF4E7272F4DE5284F69F7E6E6D4900CD830BE4771A488EF7554C72490080B8602C8DB7EA5E4
                                        Malicious:false
                                        Preview:.PNG........IHDR...0...0.....W.......IDATh..Z.]U...u.....i...JbL..P.1......A.~F....b....o..bL .../cPH..} 1&R?.@..M;.t.2.0.....p.9..sn.NGt%..u.^{.>..{.PCw=~:.O.6s..d...x......Np$.C..>r..~..g.......s.[Y...L.0....:&Z..;o.......>...k'9.VWj%n.....$Y>K.....k.5s..5.2.b.....mW.,..'.^..........@....79..b.....X8.....Q.)B..U^..x.Y...^=...<.p...GO....=...nD.B...*.IfT..q]R{w....&...X...L0...0...&.Q.z.%nv.L.=...)..K..J@.....=...x.2...7..s1..x)...v3]f.$4....7...Y&tB..&.[.LB...4.1...u..R..l.U............._...g3L.9..=....P.I@.(.d..*^.W.......U.o..yg.....}x...d..s-X.H.%..L.I0Y..#.)....>.....O.....qU..k.....P."...@bi.W..p..7....C..T...8..Z.r....as.R.....,.. e.. .W...]..c.{...S......s.#...U....F.B...RB..jIC.S'..;....1...fu.....c#V9IP.....*b.&."...O..<t..\..=r(...O..C...m....U....T...^..U.RU.g.I.......V.:...y._.v+..v..o...Rj..P.?n}2....k.15.x..kkkm. ......6.....8#.....%..n|....<{.;&..I,.I.M..+.6.n..V|..mXX.8=.......#......o.........o..e....U....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\copy_bw.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 230 x 211, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):880
                                        Entropy (8bit):6.766956341538328
                                        Encrypted:false
                                        SSDEEP:24:ZDs/6kUuzmGBBw8AkRcciRwcciR34ggSok6iRtrciRMc:+/6kUkm5NksRfRIggbkBRBRMc
                                        MD5:5838D4A177598A54BA3301FC078EA437
                                        SHA1:F2173607FF1C220FEDD1014C56BF46381D6B583C
                                        SHA-256:4BFEDC4BE17B53F40B0FB48A1B51D5BDFB0DD83EC65D02792DA2DD95BE11334D
                                        SHA-512:7CA85EA848198AF3E66950F65B7905AFDCB91FE83725AD315D6E33D4E76A74A495B547D97A9D021F4AE696CEF9E4A06D6EAC3F1E31353C999D8F2364A35B7E63
                                        Malicious:false
                                        Preview:.PNG........IHDR...............o.....bKGD..............pHYs.................tIME........t......IDATx...12%A....l.Dd32DJ....r........d.....fB...#....7..J....._U.7]3....-......&...&...&...& L.& L.& L.&....y....w.<.?.0.0.........KY.& L@. L@. L@. L@..0A.@.).b.....;.j;O...._.....Kr.UuZ..w7Z.0.a...a..z.....J...C7.0.%......., L.& L.&.d...o;....$......Jranw.a.0-e.=& L.& L.& L.& L@. L@.0Wv..s~I.hJV..d..fwI;....HKU..l...s.R..c...a...a...a................................&...&...&...& L.& L.& L.& L@. L@. L@. L@..0A..0A..0A..0.a.0.a.0.a.0.a...a...a...a................................&...&...h1.g...$.id...V>..tlf.....Xx...O..?.s\.P.L'........&...&...&...& L.& L..).b.I....=}.;.K.aw.7\.|2.].ZX.{L@. L@..0A..0A..0A..0..,.Au.;........|......I.......,............................{M..fYu.....q...................................&...&...&...& L.&..o.56...&....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\delete.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 192 x 192, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):453
                                        Entropy (8bit):5.6618159951094045
                                        Encrypted:false
                                        SSDEEP:12:6v/7nard9kX7YIw6JGrOVex/6sFzSrfq/h:Oah9o7eiwHF1p
                                        MD5:CDAF9D3ABA7E627290B2D4C812227373
                                        SHA1:C50526CB2037DE682FEB2F879AA01FAD61483A2E
                                        SHA-256:9C9373A55FA1AB543CFCDC80308522C677D517DC4837628891B97F66DC96E7AC
                                        SHA-512:799445D97083E44567B63914AC62517216B5A9515BBEE574CDD01FB6A8848B089262A6B2CA6510FC3BBC14896EE8571A37BA1B8DD64C5455017CC87DDE26FB5B
                                        Malicious:false
                                        Preview:.PNG........IHDR.............e..5...EPLTE.....................................................................R.s.....tRNS......-[...............4?.....IDATx...q.Q...3....RSBP/._....>.$I.$I.....|.Z.........yAz.Z...d..............>..@ I.:........................................................................x...=+..]+...+...*..m*.........`...w....4u..F4?u.....t..........2...6.....v...j../._........O.....E.+I.$I.$....MH..r....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\digitalbitbox.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2964
                                        Entropy (8bit):7.88984074103265
                                        Encrypted:false
                                        SSDEEP:48:9D/66ZAaiRvAFzDm2aDpXcMwf26VAqVL7Lgi4+ASvC8g8t+:lS6ZATeJm2kC/Y2C8I
                                        MD5:4648FB45C35D90272841644CEC7F5772
                                        SHA1:F2D0C1B4EA9CD8F1E679923E69E3EBEBF2506200
                                        SHA-256:8717CBEA4EE2841D109027C98253177562CE60D75C2D94D613E598509FA37C0F
                                        SHA-512:5841D71841AD3190073971DE7F8218C657D84105B671DC0F641224C0CAA889F1727E65544BC89FABCCD29B8D5E8FF358759389DC09803604A82302C913B80B2C
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............bKGD.......C......pHYs................4IDATx...LTW.......f.l.........].HlH..%..v[3.%.F......t..5.b.u.5..]-Mhuk..Mj....v.dW,;...E(.u..8..v..7.....L2..{....{..0........q.u....0p4.N3.4.S.7.Ar..."}/..eY.,....7obpp..'x.6.j..".2.\."".s.......l&..D[.lQ.\..e9P3..p.<a...QII.. ....I..+..~.i........?.xN.Sy..{...+.P:...c.g..q..|~....w.Um..fy...4{.l...h.....8...!A..,.....(..t:..yZ).....f3...E. .......... I.$I.t;.$A.E.<...A.......O..m..8D*%..P.....j....j.5..h.5..@..&.@...P....P.....j.....V..*...P...w..@.B...2........c..S'$IBcc#.....y..^L3...W.GD.m.6.3g.Rq.I....={6m..DQ...p.@;8^._gg'.....M.....c.y..>..S~...dFZ..~Hyyy.,..B.N..g.WNN.....^....J.C.A..OSRRRX.a......TWWG.I..........TUUE..{/. ..T....g-aJJ.UVVROO.......I.....[.z.j2..JM....8..@..4>>....q.....A.l..p........I...J...U....PE..B....Dz..'........=JK..U....S.........JimSS.r.3.8...w/...+..a.:...... ..D.....n.>..v2......=.>..........o.!.a..-555.........y..)U..,{.OI.h``.J

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\digitalbitbox_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2549
                                        Entropy (8bit):7.877892167190726
                                        Encrypted:false
                                        SSDEEP:48:9D/66QSPFWXHpielhcyxPFuOk9YLyowam9BSZuVNLeqCJ2GnWGE/XbwwLRVN:lSaIXxhcyxPMtswhBSwVj9GnWzRlr
                                        MD5:48E5661CC85AFD4584870B031E82F2CC
                                        SHA1:CBB45299465B71FFBF2124A0C318AF434FDED003
                                        SHA-256:42BB7B322669B0117F1E354909B64D48D0C0CEC775B700118632175A782F3B2F
                                        SHA-512:8D886C189309AD7012A414ECD9F607D53479C2C5170B0A7691D13989C4208757655A07C6AB46B0B66E4CA53B85060F010ACD1B4D927B7A02B6686071668E3645
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............bKGD.......C......pHYs.................IDATx..[h.[...L...XSm..l..|.T.=X.R..A...E....h... .|....**Z+(..6.A...'.mKZ{1.V.F+(&s......L..[f...`.I....Y{.....p......~.}..8w.}W...a@_..8....."H~.....M..,.$.2......>}...}5.p.....L.e..A...o.PTT....8.N...}...!.r...r..0....a......6..6....u+.^.....,.%.......W1o.<..b...8...8.<.^.?.W.\.{...b8.....cAD.@.......x.".A..?-@.[...Y,...S{..j..!%%.MMM#.....DD.....y.$.$I..u$I"Q..j..O...w.V...9.k.<O#...d....h.4..f.4...M....M.&@..i&@.....h....h.4..f...z70R*..].%p..\$Nz...mV..?A......l.$I"..C...}.S..n.........}.0n.8...A.a.;...M.6A..~......?._[[.....:i..u..q.FK.e.>Z.H...v..-,\....y^.p.@..^yyy.~..FK8.^... ..{..RSS..F....\.\.v...a.DQd.dWW...9.)S...`.Z.....Pk.'O..C....W....Q.$I.....,]..)))L.|..(N.....&%%a..x..O.AT_...a..,(dgg.........tW..;..P.{.1X.j.........Y....-Bww.q...=..O.<a.....c....@.....v..D....'O...+.w|..1...AD8...q.O.>...;w.....:.....HMM5d^.8..'Nd*~Y.5.S.$..~..K.d.......{.Y....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\electrum.icns

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Mac OS X icon, 830527 bytes, "ic09" type
                                        Category:dropped
                                        Size (bytes):830527
                                        Entropy (8bit):7.988734354922088
                                        Encrypted:false
                                        SSDEEP:24576:4VKk/Nu0LACehvYVzrFodFCJurMCqJPYXnVnqzZBVKk/Nu0LADR:GV0vA3rJuwR4nVqzZJVGR
                                        MD5:2B8025B601932267D73F0575FBAA300E
                                        SHA1:7218DC0CAB6A228529FD9FD498C29FC6B74BB9CE
                                        SHA-256:B4F6CFE5334B31314C0E17C6B12661D2A559465D5D90C39EC882075351B2E0EB
                                        SHA-512:78CBF22FCF4E74BCBE39F99A32F002C7815B297A61B539DAC85478A3FA9D87456E18DD3C4BD545C499C9B67EA8BC5CF9E55474AEC636D691485ED9469001A258
                                        Malicious:false
                                        Preview:icns...?ic09.....PNG........IHDR..............x......sRGB.......@.IDATx..}..]E.....N.;+Y..v...(....w.t...:.:..,2...........+`..\f\0?*....d_..d.N......N...{.;..^'UI..Nm.:..n.".D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."......G ..Y..#....t..g..Rc>...G ....*RF.".....i...dE.|y.,.6......<5o....A......9.\..3.s../6h. ..+.i.X.i.@..X!..+Y.<Y..4MN>O.7.)M..M..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\electrum.ico

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:MS Windows icon resource - 7 icons, 32x32, 8 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
                                        Category:dropped
                                        Size (bytes):63932
                                        Entropy (8bit):5.998406396761299
                                        Encrypted:false
                                        SSDEEP:768:2Bm/HQOYfp/9DRbYlbJskBsIqZ6zsS9ejNPRBTIHW1Q:2BUHQ9polbJXBrqZ6z4lPaSQ
                                        MD5:8AEC9FD7C3D563FAED700948BB821327
                                        SHA1:8ACEB0D85B7F08041B411A9AA4136B561C05F3CF
                                        SHA-256:2C4FE327580AAD0AA4B30FA15B2770BBBC0736D28C849D1B66C6767127697C4B
                                        SHA-512:CC3FFB0A841436400A41BC6C4A8308139B83822D0AADAEF429111E326C72433B0BD324F4F6B810420CB5B3CEF855DC32268FECA5CB4F0D80DFF33A8CC2BDFAFC
                                        Malicious:false
                                        Preview:...... ..........v......... ..m......@@.... .(B..$v..00.... ..%..L... .... ............... ............... .h...T...(... ...@................................hB..hE..gJ..k>..n5..r/..jJ..o:..mB..r2..jL..p:..mE..lM..q=..w+..nI..pD..mP..z(..v5..x/..sA..u=..}$..y2..tD..|,..v@..tJ..rR..qV..}1..uM..rX...+..uQ..zA......xO..u[..~A...:..yU...#...0..xZ..{S...$..x_...A...4...M...G...;..~X..}\..{c..}`...6...K...C...5..~f...^...+...,...e...[...a...<...e...j...7...8...f...D...[...I...n...N...;...a...]...F...>...r...Y...e...L...v...l...q...X...J...y...^...|...j...n...s...~...m.......}...x...i.......m...[...........f...........m...t.......{...t...........................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\electrum.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):24089
                                        Entropy (8bit):7.979796035819619
                                        Encrypted:false
                                        SSDEEP:384:qlD0+FRH+p+hd2dSNjPXbf3dPX5lbdVdw8M/wd/H74:qlY+FB+8hXjf3PVeXwR4
                                        MD5:2F9FB1639D1729737DD597193DB2902E
                                        SHA1:F418635F30225415734F5E0629CAF14FD28840FB
                                        SHA-256:0B93801E52706091B5BE0219A8F7FB6F04A095F7C5DD8BF9A0A93F5F5D6ED98E
                                        SHA-512:FBFEA5A7E2AB2AA9EFF6772C488F47E4BA9DF0923D8F395EAF850612FAA0CCD1CB4F12C620A876D909C4859C97FFA30B20A91BE16B163471441F84D5E22FA8F0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a...9.zTXtRaw profile type exif..x..iv,7.D.........`.sz.....H..T*..5........|............O.5.rm....O....s....'.?.d......../E~....|^?.z....>_.......N.\...F}r...sG...p..?.w=.?...q>.....~....Se1v.z1.p......'E.".8...>.+.?.X.5......O...O.X.g}...-...c.?....>....*..#..?9.vGo....~.......>.H.\..P_.b........3...o....g.k.G........>......_.b.'T~.a.h_k...V.[.....?;6vb.s./..{...]..5>y{^.<.c.........].}e..?.{... ..6.s..W.!...i.........mld..-s...3.%f..l+.>.';^.../....X">;s3>..O.1...B..ul....CLa..>..6w.R...iA..{......6"."......r*.[...1..s.5...(...K)...F.5.\K...^G.-..J..Yo......z....|.H.k.^?...3.4.,..6....Yi.UV]m.5v.q..n.]w.}....t...z..g........mo....}v..]..........(....5.\..%..$k...<;^...t.=...s....b.....c.`:>..........X...o..v.i....9....s..o..k{..F. y!k.BF...6x...J..;.d.B.......-b.}........"..O..Wp..%....t..w~...WW.Iz....|g...7...|6.W.*....W.......^...g.7.....N..Dld.........s..M.z.......M,.+;.....8/[..;.../..*.Wn......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\electrum_dark_icon.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 32 x 32, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):1268
                                        Entropy (8bit):6.37699756090789
                                        Encrypted:false
                                        SSDEEP:24:h8cNNOsb4p/6jaX3jBehgZ+RN2plWwIlP1EvVkROCU0IW:hNNo1p/6kX+RgEQ10IW
                                        MD5:3B5D3CF1678F1B2C1B24D0AF19CA3CFF
                                        SHA1:F1FD00A7B2B059FA9C672BCD5FE09EBF8150A8C5
                                        SHA-256:37F2A442446F7AD873DD3A1AE99DB802E138BC931E30A1B5BC8836C77DE550EE
                                        SHA-512:A73E459A288F62B9659A2A4F8AFB101875E89E2642AE93B3A93B76C56B1FF5E427380F9531F5DA9E922F38BF354D6B99D8D160CA619AD95DB57A9623EA61DA41
                                        Malicious:false
                                        Preview:.PNG........IHDR... ... .....D...... cHRM..z%..............u0...`..:....o._.F....PLTE......995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995...G.......tRNS..,....#.............%ur.Z<..(.{....[Eh3g......S@;.n.)....:.....6|T....z~. ..O]...b.4....&t....QFm2`....Ds*-..p........$..>}....bKGD....H....pHYs................7IDAT8.SW[.@.."..".....A.....Q.b.^....w.!Q...}..a....&.)../....5....i.&.U..,./(,..........k......e.z...q(7Rj(+U.L...f..,.....JH.y....R!0.&.*;g0p.*..`V..p..U....x...zq....[........:.f..&.mn.......}hi..&.,.....p.[.~.Spw..P[P.D..].n.....#.X..v.@.0.}.....Ah./....'....2C....FB.. .....a.1.q.36..Q ..1..G.L.=..R.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\electrum_darkblue.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):7661
                                        Entropy (8bit):5.121643197322132
                                        Encrypted:false
                                        SSDEEP:192:VkLIvrtV8H8yJoMH9mfL+RgGEVqo+RgGE29b+RgGExG+RgGSeJFVFNVq:mmtcx+MH9TEqTEFTE5TlHD4
                                        MD5:40A5D164613BBC21908D960A95C59BBF
                                        SHA1:803C4477F54BA3C2F177FC38182FBCC4C3A69294
                                        SHA-256:D11761E14256E2833E5F18EF84D1E39F945AEEDB82313D4D69B713D3DBA1946F
                                        SHA-512:6E4857974F037B8452B96EECC77C57751027DEF65174443F88F57C9CF4BFB314B31502611D1F8426B0E0F6573B92FF6CE24497C3B0F90DF8819A4C717A4BB506
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". version="1.1". width="779.8111". height="779.8111". id="svg2". inkscape:version="1.0.2-2 (e86c870879, 2021-01-15)". sodipodi:docname="electrum_darkblue.svg". inkscape:export-filename="/home/voegtlin/logos/electrum_blue.png". inkscape:export-xdpi="10.014582". inkscape:export-ydpi="10.014582">. <metadata. id="metadata53">. <rdf:RDF>. <cc:Work. rdf:about="">. <dc:format>image/svg+xml</dc:format>. <dc:type. rdf:resource="http://purl.org/dc/dcmitype/StillImage" />.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\electrum_darkblue_1.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 67 x 67, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5255
                                        Entropy (8bit):7.94512021036659
                                        Encrypted:false
                                        SSDEEP:96:87xJ+McLLltwsKBXQ/saCFjHEc0TBBMPHaF5TKvPOlu55w7GxF4:87+zLLlVuQ/saCNj6wH2TgPOlomuy
                                        MD5:340DF27632B9DE46EF15C1FC98EF9674
                                        SHA1:EBB2A8385B7933B9F8F4EB71D577604CEFF067EF
                                        SHA-256:E95228EC7FD1C019E2A4826186A440F2F806FC984653B06F56F0A4357A9774A2
                                        SHA-512:4E8E71ADFEB5E62063E891B8C2CBB136BDBEFBB4951E90C12E9434A516413D461E8F0CA75D297F58A4EB9C5A65DDB51C8C92113C88724F6173DC61972E21A179
                                        Malicious:false
                                        Preview:.PNG........IHDR...C...C.......s....pHYs...D...D.M..\....tEXtSoftware.www.inkscape.org..<.....IDATx..y.T...nw.>..(.1.qI"Q3..`..(F|... "D..{D.A..%.'...h".3C$n.HTf.D...-....6........r{.{.F.'....s?..9..~.T.S.*_.G.?..O.%.>.|..d\S.=8........K.......".?xv....D..:.D......v...s..B].1.^....^,...<..A...9.>.2..uXs..a`@/.N....4T........U...pB."...#fn..~.U.i..C.kP.....q.=K.......].C&..J.F...%F.a...`.n....:O\_Lq..q++........G..S'z..M.R.F.......`.jv..a...:.....a ..-F.:$..5..t.....UTg..D.X..tTF.I...F...@dj.....\.3..w._.b.R.r....*`>.J/..U.2S...7p.0.(.=...E.H._N;.s....e..U..A.v..2.W|.6..,.~...L}..h.G@i..q.kN.u..!.w......D.W..B....o4?.../...=.aW.I...R@D0ra>..6.7jCx*...n.....Z_3-W .t6......,G...|.va..S|7...... .5.......z...rh.Z.~...O.).x.Q^`H..E.wR%..|+......4P.*.5..`.>+....W7*.|wc..?..#..e8.....4.#..+..<I.yR.+..f$p5$.[.*...B..=E...t~`X...m....S[.C.r.<^....._.hC...9........Ln.z.uhcx#.,0i..)........r.;e..8..H.+..jc.^?..W/@..R.2....3...8$..<...*...%.o.....}|z...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\electrum_launcher.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 136 x 136, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12312
                                        Entropy (8bit):7.968450055550998
                                        Encrypted:false
                                        SSDEEP:384:R6Xu25TcIdJUv//QTtA7l6sLH6gw0s/D8wUQv:R6Xu2Fcnv1lFLbw1Jv
                                        MD5:59D6607E00BA5A052AFCC211560F87BE
                                        SHA1:67198BE2EDECCE3377EA08935C1CF39421756F5E
                                        SHA-256:EB6AAB81B500F634F1395A497BF8A580E8C9710899087F54BE5CBB3742120F0F
                                        SHA-512:54A561AEAB356BF126FDBB3C349D69D900A79D05F421C3FA66052951D297F92980DEFDEB37ADA64FCD1249A92CE8A6BB0DBD56C9C9E2321238672F2685FCCE87
                                        Malicious:false
                                        Preview:.PNG........IHDR.............<..R....bKGD..............pHYs...T...T.7..R....tIME.....!.TB... .IDATx..}w|TU...s...lz.!$1.$....H..J.E@@P@.. .....(".."..E..A......j....}..v.9.....M(O..Y......sf...A...4Q...n.A.5......DM.i.&.4Q.@... M...&j.H.5....2..b<p..:".f-A....>B...9.L%...M.N.#.V'.g".F.2..L..]b@...dJ/.J]..6.......K.J..y.^;..P..<d.v.ct..zf...vC..Y.Q.\......G.../.%.a%...=.5n.'..tG.T[g.)%...G...N......!FZtpe^.x:r.r.5...9w.....#.:T...0.W.po..$27..\.}..c.Rz.L^.@..~...8.....h.j...D.._E.6./^....1.&".K.......~Kv.s... ..Cq..e.4(QJ)...w}.../.....wf.yw....E..F..%.....:}.....x..>ra..D.7......!.T..(.. .=...l...'..........5...Q..o;...K...... .s....g>.e.R.!..........K.8..."3r.. .`op..A.....h..b....4a...._.....(..x$U..QS..>O.S.@Az:..A...@.$E.7%.o..<.....h$...2`.]_....... (,...`..\T0&}*.|x....8{.V..J.{.......Kx].t..=.o_.-.q2....tvc.|4.i...i...'..KG....+:._.*.f...U.W.L. ...F~..S..+.@.....).zu..H.Xn...(.\....r..^.A.m.!.&.N........w.y.b..v}.K...{I..c4.\~....!e

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\electrum_light_icon.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 32 x 32, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):1268
                                        Entropy (8bit):6.575111062657472
                                        Encrypted:false
                                        SSDEEP:24:hYNOsb4p/6jaX3jBehgZ+RN2plWwIlP1EvVkROCU0IW:hYo1p/6kX+RgEQ10IW
                                        MD5:F1682140E4059EB2AFAB3FD9146F11D3
                                        SHA1:837D7266F349E13F178A62A7254E9E7BEBE68D2C
                                        SHA-256:1C947F78BF19CB162CDE0B53EA02C2E39306D0B918B53E82457B1FF5565F0127
                                        SHA-512:E719D3FC5B57EBD12528FBFF4008D0FA91B04EE725EA0F49E22501B10396396822FED2995307FC38C790D25FEFC7E1C7E6AF40151672D85CDEC5EEB990A5EE86
                                        Malicious:false
                                        Preview:.PNG........IHDR... ... .....D...... cHRM..z%..............u0...`..:....o._.F....PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................^......tRNS..,....#.............%ur.Z<..(.{....[Eh3g......S@;.n.)....:.....6|T....z~. ..O]...b.4....&t....QFm2`....Ds*-..p........$..>}....bKGD....H....pHYs................7IDAT8.SW[.@.."..".....A.....Q.b.^....w.!Q...}..a....&.)../....5....i.&.U..,./(,..........k......e.z...q(7Rj(+U.L...f..,.....JH.y....R!0.&.*;g0p.*..`V..p..U....x...zq....[........:.f..&.mn.......}hi..&.,.....p.[.~.Spw..P[P.D..].n.....#.X..v.@.0.}.....Ah./....'....2C....FB.. .....a.1.q.36..Q ..1..G.L.=..R.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\electrum_lightblue.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):7510
                                        Entropy (8bit):5.122849632068533
                                        Encrypted:false
                                        SSDEEP:192:VkRIvrtwS8yJoeIwefLaRgGE8qoaRgGEV9baRgGETtaRgGSeJFVFNVq:mUt9x+eIsTETTEuTEMTlHD4
                                        MD5:663AEDB05ABE2CDDF526BB2E16F282AB
                                        SHA1:7576696B929E9D73278207AA4C8DADBAC60D6F57
                                        SHA-256:8BB443BD471F039A1900FE5D04147A8A96FB44A0BB830C1A9117C4886DB69CAA
                                        SHA-512:3DC3A4B256F3197F64D3EF2BC0F42F4440B659F412CA9E1D480174CD40072AC3B36618DF13346843C0CD72CADB56E644D41A18909E8D131FCCE6BA301B2105E6
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". version="1.1". width="779.8111". height="779.8111". id="svg2". inkscape:version="1.0.2-2 (e86c870879, 2021-01-15)". sodipodi:docname="electrum_lightblue.svg". inkscape:export-filename="/home/voegtlin/logos/electrum_blue.png". inkscape:export-xdpi="10.014582". inkscape:export-ydpi="10.014582">. <metadata. id="metadata53">. <rdf:RDF>. <cc:Work. rdf:about="">. <dc:format>image/svg+xml</dc:format>. <dc:type. rdf:resource="http://purl.org/dc/dcmitype/StillImage" />

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\electrum_presplash.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):25916
                                        Entropy (8bit):7.660462274725344
                                        Encrypted:false
                                        SSDEEP:384:UluH3NJNR+2Wj1/EzC89IOJIzki8fhNr/s0zLHTHX/9218udkr:8o9Jbu1MWMJIzki8DrkWbXF2rk
                                        MD5:E2AD368C2AE3B70F2F9A36B0C62144D5
                                        SHA1:E13FB5A28014344A78832AA376558CCC6CF36B65
                                        SHA-256:D738781249BD3308EECCD00537FE44D1A145E6B18832338390FBC85DC15E35FC
                                        SHA-512:F86557240B73F9DF955D6F3BF30A96D67D061CB97CB53814AF2E3138C38767BDFA29DEA6E67C02FDC3626CF69E4775E561CB1AB88E7EF493CB591EFF21400D72
                                        Malicious:false
                                        Preview:.PNG........IHDR..............x.....qiCCPicc..(.u..K.@..m-.V.. "...C...8j...)..U..B..K..W... ..k.?.UpU..E.qs.."%.k.-.py......w.?.3......l*)....w........m-d2it..G..x..^..:.@A....#.e.w...[.%x.x......q....o..x.&...`....~.S*.......i.WX.<.&!.\Y.<Fk.6.H!...*...1.&../..-.L.F..Upr.Q"o...uU)k..........$..$.|u..I.w...\...u.g@...6[.2.i..ZK.......)....0.l.\nH.Z~M.>...<0|...{.j.....m.....G...7...|h........pHYs...T...T.7..R.. .IDATx^....E..w.... H. .N......g....& .H..E.Fo....Q.}.....:....!=...........n.rw...v.;.7.....3.R..@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\electrum_text.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 326 x 67, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):7439
                                        Entropy (8bit):7.950993607765179
                                        Encrypted:false
                                        SSDEEP:192:a254DuRPm3ML7dsr6VPpDLwxTUob1J0GNjau:a2WDcm3yagLM4oTNWu
                                        MD5:BB1928F3F68D01269AAA1EABDAB6835B
                                        SHA1:6A3C4F650AD3ECA30512769D0B1A2400940E2DC5
                                        SHA-256:55BFAB6AF8D6C82AF2E039A1F02210AA486D572E96810FE533B01E63DD4F2666
                                        SHA-512:25E4B06DBB51E42F37F32905054E74C76C70CAF27253282A0E85E20F853403817CE3F2734FE42DA21A3AF62FB5DAFE95CD0B77E280069448E3837383142BE284
                                        Malicious:false
                                        Preview:.PNG........IHDR...F...C......m......pHYs...T...T.7..R....IDATx.....E..........9.A.PA.8..O.(.D..."H.%|z `B.;=E..=E%.H.I$.%'I...z.wgfgfggg.......\OW..VU.lT...a.0`.0........a.0`.0........a.0`.0........a.0`.0........a.0`.0........a.0`.0........a.0`.0........a.0`.0.......4.@.P[...O.3e..).o...s....p..F....r.q.....l.G...+.6..dw.c..I.)....L.6..$..{n{...$..T@...0;.Uw'...'L..s....r.a..Z.L.M.j0.dv.lE.Z.V$.R..*.N.u..].. .R.=1.[..J...K..a.+/'...k_ll....i.c....?.}..Q.Q..F.>..M....|.geG..W.v....Dv.se.J....t^...C..W.x.>K.....X.m.X|#~AK..?&rs./W.\.to.&..u.[.'.q.g..J]....:mu\Qc..O.y8fR._._....'.LB..PW[-w....?.X......I.|.[..j..6...o...IN..b<...Q)q5N-...?..s.F.=...t..X.P.U...Z..B.q.:8~.{..@9..*.....$.C!y\.8y....y...BVv.?a..H......>...^!.J..O.,.}...6."..q.(.D.sxws..&.</..[.c.;.\j....S.........g7....g>o%.. ...........4*=...!?%t....q..gE.".....r].n~..].<.K.0..8+.UJ8A5N........@rK.=#ikw...h..p.6.........+..hj..:....l..>.u....D1..(.....ST.).......@.&7...K_.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\electrumb.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 163 x 148, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):2510
                                        Entropy (8bit):7.888842297003142
                                        Encrypted:false
                                        SSDEEP:48:cB/6mGU6ToQRR/Q3gmPQ5mV1KP1GweR4IrndDuZMWTQ8NUXLXNovrTaSrJwSOndU:+S7hbDWgmPM1b04Ip6CWTQwcerrJwSQW
                                        MD5:9BAF924AC5D7086FE1427B8E16825707
                                        SHA1:349F180EC748B6E9677436244A836C8BB0A07224
                                        SHA-256:FE3926386E4EFAD5EC7FE9324509E4A12C703417FBCA7EFB8BD03C435B1C23CD
                                        SHA-512:AD2120D1DB9F6869F9B65FC0217507653F7E2C47B597964E3017C6CA5E07382ADA0FF20D14BE93AF2C3637DF22C4C049A11758FDD0F095122196485E58182E43
                                        Malicious:false
                                        Preview:.PNG........IHDR.............U.Q.....bKGD.........pHYs.................tIME........"...._IDATx..]AhVG......_..."....@.K"......A/5.(h1..!A""^=y.'.....K=$./....F"B.Q.'.hM.O.Cl..........)....~.....]..RJ)...B....m.-<.&...UlF#6.X.K<..f1.g....c.-a._...<.>.T.9...I.....=..Cl!C.....^...[K.;.wm...m.....6.....7.B...i.WV....p7.D..-...8.<<....ch..y....HC#7..).[.0...x.w.xA..2.....vn..y.........P.M.x.K.8X%.4....s......?gv.h~...f#w.O....:zw.e.?3.T.!?...>Oj...>..Z<g.).....:k.-..G,+....N.).....k@a...@....32...T..8.?..|A..*.7..O.+ ..yLh.......A....H..\.>.O..@.1.)..M...1.B66.F_....YL...:...H-..kf..#..N..Y....-....9u...K.. .#..i.B.... .r...w.e.Mk.v...2u..9|u........J6rw..!B.._T...a.....G.V.z.m.5.R9..Q7.2.......[5..pjn..Z8.?..jt...xH.... ...d.....#...y0RSc).#.....@.......>\.....Q1...9...9...=e..X.....,$C..j.H.d|..8`......A.ko...E.`...0=.....d..c>{.Cr/R.{p...2....n.k..x.1.ZV..x......{.....>.....'M/..D..U.f....^....S.l.e.T...Y.".:5...8r..%..D..+.`.y...f

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\expired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):28522
                                        Entropy (8bit):7.923983218809425
                                        Encrypted:false
                                        SSDEEP:768:7wsMky1PGVyYNHwqMXl0QO/34KIu6/gShOdE/+ljF:7wswGVyVqMXeQOgKIzPGljF
                                        MD5:68AE369A54DCD7B6D0420C6E980E6A03
                                        SHA1:D16551DBEAD0E2F01154D4921514F67FBF868DE6
                                        SHA-256:21FD0371214571ADD1005346F98391C8A05AA5F3116ABBDCBDD06E54EFBDE606
                                        SHA-512:4ABF6BB49856E8316D4203061A94D8BAF666102877CD374331FA8532DDB2BE21610E4FBA3D745C59E26C977C7EB64503954AB16BA1866C7A4077924E01980BB2
                                        Malicious:false
                                        Preview:.PNG........IHDR.............\r.f..o1IDATx..]...D.>.-...oc...,u.E@P.R.)UD......`....P...v.".O....(XP...m,l...s.$.z'...@6...L....9mf......J..m..\.6W7.`....%.L...n.m...2.w.A...N?..d...70.z. ....q...@...]..B#.D.......n...H..:.f..Z......>.w{..je..vn./0C.6nO.K.l.........2N....;..;.........R...M...b..nw..l.....q.. .w.....W.6.w~...v.Of.oq..6$.....q..8..I..{....m.w....V. p2...?!!4...^... A....Z....~n.=...S..+q.k.d.......^n..q..Q..e..8....H....+'M...:.~.d`.x+....@.....w....ia.l.j}x..+~..o.D......e..R......p.......;..........ZA*.'.......p..n[..{..E.]P.!.:Z...ZA".'.MA...........e.u.X.f.R+.<....>..#...B....'5.(#"9'.l.v|;....>.Dp_qw..2N.!...vy...Q..R.5.{......O..h>P.%zW...'w.J.....\..d....zil........d... .....v2.Z..{ny.-.(R.....a=Q...l.......O...W...)...2...}3gBe......i.<4..d(O.........R....>0.e0(g..n......M.l.....5V..UP..e.[..F.-..g....../w.M..[.o..m..F"x....z.h..N...^...mF.:....N..S^./L.}w..fk.=.J.'!.;..m..ct.......a...a........c.....M.ji$..._..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\eye1.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2910
                                        Entropy (8bit):7.909019751618405
                                        Encrypted:false
                                        SSDEEP:48:/Ud8vu7I4tXacl6KlvRpOrDvig7gH/BpjemizVZWAa15ZXH2JX:rvu7XKWBkD6EgH/Bdyfo15ZXyX
                                        MD5:AF5E1B19B9DD704F021416857EFA8B13
                                        SHA1:4ECD31A78CD4EFB2AD4F9D9E6E81B37D4BEDE078
                                        SHA-256:C94D800E645AE2E63A194BC67772E5401848BDF8BF664F102F39D67B76A53ABA
                                        SHA-512:62370880FE43334DCB37F1F167391E44D55B1AC843D15A46A6D243AA79C8AE1935239676E896877FD39F99293CE063A7F20229D8F8B616260F4111D67DBB2768
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....sBIT....|.d.....pHYs..........u85....tEXtSoftware.www.inkscape.org..<.....IDATx..yp......Gv..6.M..9.JH.\*..B.....`....N.aj..Z..E.k........p...i..r(....H.Eb....^..?6..fw...?............|..|.!B..."D..!B..."D..C....Npi..T..U1...V..U.V.7o~...?X..O.3g.2Rj..$L.&....!.uJ....../...[.5~_}....\r[."<..b>RN..K4...\.6.\.}....O....Q<{.,U.....C5....F.....x.=..=x\N.C........k.1.S.R. f.,..!~...,T4..31%&{.#...c.5.^...,.f.X.........m.*Vs.....(.Yx.*.W.rb8.y....{...n...Q.?E.W...._..[7U...@s..n...C^~.3R......Qz=.....?..+..:.BQ.edY.q.<.......F...tb.K..c.l...h+U.]9y.LcsG}R]]..i3......Y..s..,....u,.m!WO......`..g.us......-..1).IM`R...v+.t..mK(.H......B{.IT.7h...g...?Q.....q.*.s.r..VW.........&%[...tQA>O>..._{.o.......dL....)....O.(+...(...#..m......!&..3R(.n...h......@{{'..X.M7\GSs....|UR...;.=.N.;.m..V[.9..$..Fz.PX....+.#3#...F.....0"3/..9&*.9.H...?...;.pd.8m]...h.#..O....P......ILL...../...V.*..=...lX.0.d.<..'..`N....e..[Qz;W]s.?'.,.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\file.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4779
                                        Entropy (8bit):7.489422017671005
                                        Encrypted:false
                                        SSDEEP:96:NAlOXNL5rVVdr5VgoMaqxcY/kY3SVfAD4I3q8UispwTwI5:uytrVVdNmX1/opi4I3qMlTw4
                                        MD5:897DED1ED1153E7B0836E8898300E82E
                                        SHA1:41A7F5CE4CEF08B5D3994B40590F1C60F7AFBDAC
                                        SHA-256:6FA888B5F96C290F66AACF2D902F6B17B7E386FA4BF0BF2C645CA8721480369A
                                        SHA-512:86EE44953A89BC9DA715C9A7B68B4376D2BD38F14DC5072EF590F8BB70C88C2F68D1231E4D418290B4D161E194B75C270AD2E0125AD7DD7262F4CDE2675FFF99
                                        Malicious:false
                                        Preview:.PNG........IHDR.............k.XT....sRGB.........gAMA......a.....PLTE....yD.zD.{E.{E.|E.|F.}G.~F.~G.~G.}I..H..L..H..M..O..H..I..J..J..S..T..I..J..K..J..K..L..M..K..L..M..N..O..M..N..N..V..P..X..]..^.._..Q..Q..R..S..P..S..T..T..U..P..Q..R..V..V..R..S..T..T..X..Y..Y..Z..[..T..U..U..V..V..W..W..[..\..]..X..^.._..b..g..h..i..`..{..|..|..}..~.....X..Y..X.Y.Z.Z.[..a.[.\.\.].].^.].^._._..a.b.c.c.d.d.e.f.f.g.g.h.h.i.h.i.k.`.a.b.c.l.m.c.c.d.e.n.o.e.p.q.q.r.r.s.t.v.w.x.y.y.z..z..{..{..|..|..}..}..~..~..~..~...........................................................................................................................................................................................................................................................................)`....tRNS......................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\freeze.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):4328
                                        Entropy (8bit):7.917063105549831
                                        Encrypted:false
                                        SSDEEP:96:5eKnaW8i7leOeG+O8WZxBiXAazywYTtvD0AnR3dX4wpNOAvtz:5eKNl8GT8QXYz+TVn3phtz
                                        MD5:F2BEC482842D6EA87DA2610701D348E2
                                        SHA1:2AFEBDB8BE30D7C53B5740D10C90A8DA1C0FD1D2
                                        SHA-256:F3C9D70B977D5DCDF883D07B14CB48D731EAB28C9388CE502F33A2033930FAFB
                                        SHA-512:ACA1DDABAA177FE36EDD753F6E77652861E1329362A5D48FB261E8A15BA972A12C466CDB161B5E99878CE92038A1BF9B3DE5E529D784A550E86674E13681B04A
                                        Malicious:false
                                        Preview:.PNG........IHDR...x...x.....9d6.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<....uIDATx......}.....!.&.z..D1.Zm..m.Z"M|)...m^BP.f...A,"h=.@.1.........e.%i...T.Q.kTD.....&...1....O..x.w{.3..._/.`...0........eJ....(..e.K...%NY...,p.S...).\...q*....q].(E.p..i~...OGsM.I......g.w.0...+py..q...8e.K...%NY...,p.S...).\.....K..R9.s..3f4.....X)Z.b.msyXs..5...1cxs.:>..<aR...6..7..Dx..y..c.s8.3..e`...F"|K...(..V..........qp\.?.b8..,.....g.....8...v!(:.m.."\=.J.T..CK[[~...e.........1D......fE.X..:.H.!.@G]./uuqi.&+....x.0.~M....<.[p....m.Y".s..%......`.VVr.5..<.Q.........V.8u$..OH$X.c...h.^....V...KyL..*..r..[.m.Y..?.q..F..m..1..KEX........u`.i.....q.e;...=......#B..s.........X.XE.+..*@B\..J..D........mmD....@2.t..V.....jn....e.Rt..k."-.w..E............Q.i.../...==.....M..i..B...s..;Z..D.H$..8,^..j.6...i.....J..|....._.,.[...q.9c.|.u.b...8|)....wu.g.,.S..*^t]..j...g.?.eY*.$......~.h...T.bK.k...v.8..ExU)f.".A#f..nk.H.Y...9...A..X.S...Ks3.4M.(.t....?..0

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\globe.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5938
                                        Entropy (8bit):7.882084294102423
                                        Encrypted:false
                                        SSDEEP:96:IgbxssDKO3kLnQxyCyVap5OESodKg1XgZPvabCWtM7qZNCoqmWEEOHr5gj9H62:IgdsQKlkxnyVapR3NwZvOMYCoqJPO6F
                                        MD5:F4DD4CE45C589748F88A7C8DE1F476EC
                                        SHA1:268107F65556A9B5F9862A2DF9190102E25D80F1
                                        SHA-256:88EBD17E7FB233C4A26FE09CBE08A53AA80544DA531A751B273B53E94E03F980
                                        SHA-512:D450CC29CDB98BFECE9243C237D6E975BE2A1B3C72325315A9903B369C6E420968A634494F520931B807A48AC61AE6CDC9FE14EAD1EF6E2A2C8A06BC79E9929F
                                        Malicious:false
                                        Preview:.PNG........IHDR...H...H.....U.G....gAMA......a.....bKGD..............pHYs.."s.."s..*......tIME.......K.......iTXtComment.....Created with GIMPd.e.....IDATx..\]s..q=.w.X. .....HP..!...$[.E%N9Uq.TT.G._...r..*.%.m.L.d."EI.H.D.....H,vg......H..l..U[....3}.O.>.w..........~d..E..0.`=....eY...B.Z.e.B..................3..>..EQl....M3......z......w7w_T.y3[.0....\.p.?/...P|..49.4...f........[.E...:......y..FOi.(.......EU...#...8...&'..l~....x..Q3..`..l.0L.8/x..o.Y.......|.G.{.D.M..y.o.8.p.?G........>w..`XD..[r.7.}...U]..n...{z...h..1.A.M..OD..^W.......6.t...?.....=+"...6.\U.J_.J.e9.B..p......I.._..NU7.x..7..u..... 3..:..{..AU.MC....Ob ......l..l...q.h..z..;!..$.y....I.c..#<....w.U.i...y....8...~.s.....x..*".U..'|.n.D$..z..s..:...H{..2.}.^..<8....%w..zEd.............$.>............w.@......MD..=..G...L...$..S...... ...(-R..1p.@DD.}DD.2.Aw_.B8Fj....Z_..+"rTD.......]E...*.Z..!w....>.B...)......D..X.f.0.W...b.2...v......>r.......S7......,"....L..Y..w....'.H.m...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\hamburger.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 49 x 49, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):240
                                        Entropy (8bit):6.393418700587928
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPfG+aWdKcnAI/CBlo3WumGhgqtmgTck/IjUVp:6v/7aaZpCBljujhP4kV7
                                        MD5:4F76DABD56693B941D6A8119C1ADC2C3
                                        SHA1:22F77B79A7AA5F110E231B78DF04EB3C2EEB70E9
                                        SHA-256:5A10D64A13D8F86AF568F42C3A8017D3CC7D1EF8619BFD97B5E26D172DF21294
                                        SHA-512:44D810B84C2E20850AF877870B08B1E550DCFBAE3F58259C86FC1E86E3AC23D494A895F26CADBCD060AE3E772EC2479F46D68D344A3FABDD1B81EB7D1704542B
                                        Malicious:false
                                        Preview:.PNG........IHDR...1...1.....s.A.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<....}IDATh......0.......ZS,".Nd^.. .dfsG../.Aa..Hru.XUsn....9.Aa....FP.Aa.E%..G..x.`0....#..=b....#(..0....#(...$g..U..(..0....m...Fj.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\hd.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2223
                                        Entropy (8bit):7.740472932124116
                                        Encrypted:false
                                        SSDEEP:48:JaIFLkqMHmq9q9q99q9qzu88l4Tb4g7vZZcfUCAIxxnsEq4pkI40x9Oalat3ezQB:NhMGq9q9q99q9qzu88lKvTc8ClmH0x9k
                                        MD5:731AAE63A66214ED1268629B506B7068
                                        SHA1:2C395C457408811CC4675B9A726E29F6D1F03C01
                                        SHA-256:A43B3AA5015F0FCA47F578BAE4E9AD8E9E40CFCC3296E2F2CA2A297185F5126F
                                        SHA-512:A753C82A8BD4E3E79E2D980125857C177510A5DF4155768C3FCD99B04B8FB7136B38B9BF9F3A687CEBBA8BDCD05A4F3E7C75F66280C1135A053C793559A00FCC
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<....<IDATx..{..E.....K)(I.BA.G.. j.H.Z#"b...$.X.by...X.jJ.M......"&.A...i..ZB.....(r...Z....iK[..%..;.;.;{.......3..y.....~.".c.#.....`...8..q\....;@[Tu90...kE._=..i/...xu....L[...0..`...8..q\....q.......0..`...8..q\....q.......0..`...8..q\....q.......0..`...8..q\......X.~.0'q....C.=..l...]..0a.5q...`...E.>..w..q.......0..`...8..q\....q.......0..`...8..q\....q.......0..`.l..U.".\.u..p....f.I..!".r.\.p........}...1 ....L?..,..Y.9.!.....r.9l...x.*@.A`Y.3..gl'.7....l......^.........)@Y..<W...Tu...D.oc.S.....w.....r....8Sp.......px.].q\.g...!|.`......8Sp...c..x.`......`......g.Y.h...Tu.p.aQ.+G...p;.YD..j,..z,p'p....I"....P.#.+...>..?Td'.U`.....F...L...'.."w....X%"[..m....\.\....[Rt?.[`..#.yb<.AU..+.../.....;.7D.?M.M..X...8.I..n....v4.#.U=.pfZ..M.....Ed[.l/Pd\NX....<.|..ED...h.Tu....*9.h......3.w...F.....Um.>*"..Ou(.:..).(S.7..Ddw..3&''k...q.~....0.X:...099.u:...!../.P.,`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\hd_white.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2194
                                        Entropy (8bit):7.747910511101916
                                        Encrypted:false
                                        SSDEEP:48:JlHPEFq9q9q9Tq9qOroRkJGp7EEOCJManZ64s/AqSbfezjv0J9/h2jslI1BDK:zQq9q9q9Tq9qNqGpExAManNs/NqfePcn
                                        MD5:7C9CD2F1C58CF0C259F5EABCDAA9F692
                                        SHA1:143A06BF5A9A04119F3D2B7CFFF406AE8A39F180
                                        SHA-256:4EAF310920B4266B69081321D520DEF286824797516DB081DB09CD847C302E3A
                                        SHA-512:9C15A86E42A0BC2474CE8183F4C887E438EEE5786BD6EA970023E699741AF6D684E0FAE54E22E856262CC010BFB74447A8FAD6741EC7D0AA4DC58DF9DEC441BC
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....IDATx..k..E.....ZP.R...C.....)5.D....Q.. .>*..U......`....`4..j...%.....D!.\"..b/.k.......gwgvgw..<.o=;;......w.E.p.r....aq.......0..`.iC.h....f..a...{..[1.....o......V.........0..`...8..q\....q.......0..`...8..q\....q.......0..`...8..q\....q.......0..`...8..q...._..H.."...^..6h......b.5q..S.......!C...........0..`...8..q\....q.......0..`...8..q\....q.......0..`...8....|..\.u..p.i....$.l..l9s..8..X...f*p..!"x..&.w...=9+.)@.`N?..`J..r.._......s.X..-..2......|..x..Y.f'..^..%pR.......x\D^(.6..:N.="....T....|.].!.}.\.C....\.Ct~i....x.`......`..........\.C...8.....p&...........@V.Z...U...',.y."..n...V.e@U....N...8FD.....z.a..Y.'.#F.l.........H.U..|...pB.n[....EdCr.-P.#...s.3..J...~...n....I..:.X.\..*r........6i7Y.b..J..&...o.D...(T. ./.R`f../.\!".rg{.".b..W6..I...M"..ED...S.U.......p..<...}P....sZV.......>...L.g..LU..,...;D........\..l.> "..Y..........=.r`Y.7..U=..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\info.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1771
                                        Entropy (8bit):7.863050634593692
                                        Encrypted:false
                                        SSDEEP:48:9laNhVnnXTRYSXZMtq6Z2KDUIg1el8brT:TQn6U6ZVRg7/
                                        MD5:4DBA583BB7498C02B0C5F5CCAFD7CF4A
                                        SHA1:52485A4DED1E0BAE4F91D9E589F91CF5085467B1
                                        SHA-256:C7C8304731844C489538D77D2E1C8618E3140E868972532101CC0760987B6ECE
                                        SHA-512:19FD7AD28C8B05A84DF459DAFD8BB5A117097044DAC266D05139338472B30C452574F098A854B7DDB3ADE8E87CD411CD4A546BE3F8D6D51B049CCD45ED22CCCF
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...2......?......sBIT....|.d.....pHYs...M...M..9`c....tEXtSoftware.www.inkscape.org..<....hIDATh..[lSG......=v..U..IPA.........]..-m......Vj...J..m.v....K[.&Um.E..$....$........v|9>.}H..1..>..h.o.93...o.sf.e.....o.j.4C .H!.....w.8...V.V..$.._........wz72........H.U.W.[.t8l..4....&....t&.J..$....> .y....^.RbwO....5f....2..G`..5>..".*.0..F8....z<....if.~x...!...B....L..`.#..k...Q..<.63.h,..+7..cQ")...x..y..6.......p9..J....5..=h.r;K.z......].G..z.W_....?o.soQB:...;l.S!.e../V..."\...7?.d(V...y........>.......n.nl...vk.].d:.....x<u. .:.........'..X...Zo...6MJ...E0L...l8...M...+.?..=..9x.Q.....VI..%.hX)...6.....:....+T...o.......x=.m.-....$....j^...n....>...W.X7e.%......%~...I...;...t..(Tg.P?~..&.r`..-.....d......E...........L.M...}._6o.5...>PmZ!b.C....;...=D.........LH.......N...jK...l.u9.$|.;.>........f.i..{{z;..s......._....+BF....?....<.V.z.9..\_..0....X..u,33O.....i*...9..g...L...x\...m..........W......_....M

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\jade.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3445
                                        Entropy (8bit):7.919405513986357
                                        Encrypted:false
                                        SSDEEP:96:qe2TP/jq76KuWoE5ymTkOkFpwWDGTBGiuzHq:q/698ERkffuRuzHq
                                        MD5:EE4BA2B73A1F674EEA342CD51B17D354
                                        SHA1:E381C0F26C9A8529B116F739EF8F845606DBA67A
                                        SHA-256:FDFCFFCF836708F270DCD9C35CD1583D1712CCFE690B1BE0F368756FCF85AC57
                                        SHA-512:2D47E248B8916B1C1CE1F6457ADD4A5A91FFAB50F234D17D929A64ADEA03D44CF509FAAA4472C68B3334555F3C1661260470256468C5ADB743676232DC2E59E7
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs...........~....'IDATx..\ml...~m.ml...zg.M..pM.&.i....JRR>SHU..P..L...Z.H.G.J...5I1..."..).B.|%.%*.X......;]..a....z.f...w;.{gR..V....g..yg....h..>.=..h..... .6.1.7w..c.h.....sq..LD.DtI....R.....{a.....r.t`.6":.#...r`<%..@.i.h%..'.V..TIfR...AD.$.&.8.{.....IR.t..#!..D\,@..`..E2.w....^.....y..M...F2.wL....J.E.......FG$...N.R.8..LB..#.G`.@....z:...I`....m...I.z..R........%...<....[og.K..4y.y.9n.eO..~o?y.zn^ujx3.e0.r.r....m.@..9K(.l.e..E}..p<.8?..U..x.....v.....OY..T..*."..O!.^...t..w....O....3u.........h..6.MTq.P.>.....m...E...mvWS........x...u..z;B...q%..;...Be..9 :=g.;F._Gy/.S.O[.H$.W......Z.^d.....m+3.I....../.q=.......u....g/.._..k.......@r....+.q1&......&P....=..r.....A..@.$.....Y...[\Bm.....)....=...S.p.=Qs.}..F..&P..l..cJ...W.m....'h.....Z.VG...&._J.............a3!a..BFZIQ.u............j..*...`U.....Y&.KL /I.T..PA.[k..=7.FID~A!M[UA.wVQy.Q.....s....[.;..}.(.`4uw...........x.$.2S.5C....Y....G.gj.A...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\jade_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3431
                                        Entropy (8bit):7.921064358027522
                                        Encrypted:false
                                        SSDEEP:48:uCdGGBsq+ea2IH/PhTHcOXNskoG+2/2bXE3pkb6Ep3DkTaGCS6w6ISJHazAObOu4:jsq/TmVHcCwskmRBDShiAWOMfENjkq
                                        MD5:9531E35DE38675AD0E5F1BF4055D0E6D
                                        SHA1:9C3F4EED41AF519D220FC626DF8C2F536EACABDD
                                        SHA-256:AF909A3D42B8683A4E3680E6A517F832ADCAFE8A4CD835EBCA01DF3B7F3B43FD
                                        SHA-512:C00159AEBF8DADD4A46CE7A89786F9DF827F40A997C0A5B737B0DC7A06A605BB0D2165C78BCF8ADB277521ADE8D0CA0E7FE97644551A72EACB2D6E894BB0D636
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs...........~.....IDATx..\mlS..~I.......)I(.f.Y2`..V>.`......I.....i*Z.*QR.45......`.P`...`|uM$&` .A..B.-..E......ss..k.s.C.<.........=wX__...:....!.mb.@..".&......w...""..x!.)W......W(....".^....$.......2LD........O.)!.K.z"ZIDyI.. .*U..T.9qo..kI..1.....L2/...]n.(H. .....2...............#B.q.t.........@.u..x.....B'....t.....=.......H...&.....I.wu...!>o...|...1.T.~(.E.e..? .x.........:M^Zv.e..H.eS...S....u..7.....*+'*...a.&.D..YBY.s)..<...q.../......l....m.......<T...{....&F....@^oG+.....#k.<.*....m.......l<.....{..?l...........k..v.CF`G.I......moa.g./....=..U.....5j.:.}.G..o.#..]u..wV(.o6{.i..3.w...$.+.Q..@...:j..n..4..sf/.......|...{...si...m\......7....CA.z....@...R!.9...H..t^k.p..\...P.AcB. ..6.p...>j9RKcj....[..^..*...VsLI w..-.0c.D...?.P..c@Z...T:..y...>.y.$........{..i%EE...B7..............VU.l(.e.....m..........}.z.D....U.taW....pn.{..h.......r..........."2V.m...L.......g.....5...}.......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\kangaroo.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 452 x 452, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):15433
                                        Entropy (8bit):7.920012489860019
                                        Encrypted:false
                                        SSDEEP:384:KbbzWewCmX4GFOHLtdVWIgj00ANXmDg0HYicAgAw:KbHqCYhOH5HR0pumR4mw
                                        MD5:BD9ED008918AD8DBC4A83E5E080CB38D
                                        SHA1:CF452561E68CC1B439C75E32505AAD26E3F466E4
                                        SHA-256:B9F0C0F86F9BD33D5058F13E1A24E5F25F197889EFD705B23212B2D53ED5043B
                                        SHA-512:77D1A83C55BA1F03A4A749E9859116007F4C982F048C48334A90F733EB8F0AD2219909C4661A529021D94EC73BE29BFC788720DE8670ABD116F9E3C44326A844
                                        Malicious:false
                                        Preview:.PNG........IHDR.............._Z.....bKGD............ .IDATx...y.\U.7..snUo.^b...WTD..4........ ....:.....3.:...;:...@.N..v..8#.(...tw.d....}.?:..........1...u...........................................................................................................Q.47...j....:.."......s+.~."...........f....<...z..q]....HD4.mW.o4.........!S"."..o....a.H.!......3.|...P\...r.D..DDch..n..w..U.k..b .......^....8.u-Tz..HD4.}W.{5|...a.` ....ok.2.iW..u-d..L...h...B@.b..Z......N..M..7.]......c........^...n.3\.Bn..HDeo....4Ap7..e.=D"*k.W.....@..Z.-....l=p#.i.;...u-..{.DT....*...h`....R.j...:.uPt0...........\.A..@$...~.U....@..Z(Zx....J!..e./w].E.{.DT6.]U...nH.` .QY.u...x.F.@$..P).......x....o.uo..[\.A...".%Z.R.....q].E.{.D.h..u...\.uP...HD..vE...>.....".%.1.1.w...0..(..]5.%...u....D"J&....\.A..@$...e....u../.D"J......F..7..%.+.....uP.0..(QR&x'x.&..HD...jg..Y.0..(1z{.Z..\.A...(1..^].1....w.|E~YK.......-.%B....C.g.*....|.s.........0.......~..w...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\keepkey.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2766
                                        Entropy (8bit):7.892837039684091
                                        Encrypted:false
                                        SSDEEP:48:9Bs/6U0323aiGMu3+RTfkxly0PwOorPlrO1C9d4PI5A1awAy1xXKwt:jsSU032VGM3qi0PsrNOB1awAyX6w
                                        MD5:1EBB938309C368D0601121FAB8F0F2D0
                                        SHA1:681E7EC01839FB1A554B7C99773051D8AAC81422
                                        SHA-256:138658406FBB5631E86F232914D3682ECC389AB38153C344C98A4104EE8032A6
                                        SHA-512:14502CD433D15B80DA4E6D988CB7EF961B862AEC22A3F8BB0F7A0358ED956DEB6A14B802D937C585909B2332ACBD39304597F57029E60B5C1F96B23B41ADE83E
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............bKGD.3.7.E8P?#....pHYs.................tIME........v.....[IDATx..{PT....}..^uq.Q|..kC.>f....4.hR..?jTZcQ.h... ....b...c../2i......G.&"F..hD%...8.B.v.>.......{.ww....3.....v?......;..RJ.6.f.#........fR.....QV..w..r466..... .n..O.....X.h.""".-@......9.....{..n{&..........ZKK.S`Rx2...>._y.....0@..9....x..6.......0@/.2h.mL..........z..u.Q.....0@.t#..v\......a.L@T..$....t8....f..o]..C.B.....AcC.._.....(c#........p....A.c.[......q...DDF...h....n.i....a.u5g..q.=.........m......{..A... .....4>.ty ...%........oamA0,g4...9.;..c......0......DE....H(}......ee.!...;#F..+W.p.D&a(C.......ihkkc{~.qqq.7..].G...{...26nD..6.]..AX......f.M....g...$.M...Q.s...9...../........T......}..z......oa...^{..x..X[.....<.......?..coxg|..}.....l..@...W._..{...`..0.q.. ....3v..i..}u@.....L.y7;9Po.....3g.!vd. ..x.6.7.7[..n....=....'..<}B..&....c.hjl.h...x.....O..%@Vi...~.......=...".q(|..S~0e.4.|.. ....;.p..,.............C.dd...)....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\keepkey_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2726
                                        Entropy (8bit):7.885679156988498
                                        Encrypted:false
                                        SSDEEP:48:9Bs/6NrqJ08tTnmYp4/yfJljkrHg5ALnjH/+iPVDY/dzZQIIEDtQtUII0G8261e:jsSILpnV7jkraALj2itD4dFtIStMpG8K
                                        MD5:35A93B6F9C34D75D8E8E5FFA73722C57
                                        SHA1:21AF5562A93503AC670BD8CDB2771DA2B8AA80E2
                                        SHA-256:21E768B2394316BB4D8EBAC274A6E95F3AF87D8B39B5E76EB6CF9377B875F042
                                        SHA-512:AB698CD02BA077076416B55D8D9678B0C138B3EBFAD31A52FD69DB734C236BC36110F9E79490164D427BF07BEE94E5AF87789E7AB3B545E21AD3D80D90F3908D
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............bKGD.3.7.E8P?#....pHYs.................tIME......("......3IDATx..]kPT..~..gw.......p.6.Llf.-.3.:#6M..G.JbRT4.A.. N4.Q.Z,I.....t2.4...F.aJT.p....! {9..e..|....9....|g..~......J).i..3!0.4.4....=q..]....7...z........ @b.8L.:..Y..;o.bccG,.D-..........g...{2.Il)....s.K.....`R.dv..M...>...&.R..J...$.y...l.{.......&.....].]8s..`.xZ............?.y..... ..2..*.'.....v.L.....G}.R..5....*...6.:y..n.Rr#..c#]H...ra._.E...[...III8y.4b...-.7.....SS.R..#p...I.'.x.".P.D.N...l^....1=P..6=/...r....!..2....../xPs..#AS...0.sT..M... .*3..p...Sf...M........7n.Bm-@....1....C.@".0.!m.l....by......nbb...@..Qh...aw..A.U...P..8*~.0L.X.F...^.]...V6M.!....o.....b.<._..}....1.j...@.._.s..V.|.S(.sF..q..R_....@y......{..G|..}...\.l......N.:.7.mc.*..}R.$$.K...........*......cc~>.....h.GNIO....al..aX...mkm...CoOo.Y...?WT.....i.."...>.^.....Zcl.X.SQ.........H?....a...'.4@..l(.S9&.t.cPL..a.(.".lr.|mmxU.........y5......(....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\key.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5428
                                        Entropy (8bit):7.949392842023817
                                        Encrypted:false
                                        SSDEEP:96:xSIK8dZ37PTa2Axpa8wqVfx/3oYBdIM9TGBFAW/CG3FFfsqctJecttHMK9:xSH8T7u2ALDtBisTWFRH1F6tJBN9
                                        MD5:8B6004564A09C5CBC57FE5E7ABCD7B56
                                        SHA1:59B3ADEFE7ED3EFA5484AEC360F658A38FB8EDD5
                                        SHA-256:6683C3D397403B789F4E3F13CCC065A0A863830F7393EDED843DFE6075971A49
                                        SHA-512:FEE2C164C7FB28EB29931EA24A19072F4BAD031CC5665CE18B173C336ECE922AB99CC2B1B6072690EC9499BDBD2BA28D60AFBFB738965F1F2613BC6FCE24A69C
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....bKGD..............pHYs.................tIME.....;..0.....IDATx..y|......33;......9.Z..)I.B+..j.?.Ykkk.b...^.z...V.jmk...."Z.Z.*.........;@.M...f........Zm..>..f2.d.s|..G....eL...J16..t.b4..5M:-.{.......ZTe.T..k..G.,U.P9..BrsW........0...s.a..../Q.."mM4..IC].u..}.......W.2._!..p.....d'.L..<.}c&.G}..{'.@*......X.||y.H_......sO..i...,*.j..q..GJ...\...........Ee.i..4.]....i....L.Rd......~.(.6...e..<...I...1o..$Sl...@.G!A..............q.:..._.e5....?P.W"1L..(TF.\.V..xD...D[2hl...N..Q..y......6.U...C@e.hM.q.Yq.I.f.a.....\C.e.//a.h..Q..B)..z...r4Ze.q..v4Zk.Q...\.....s.P..>......5<.a.e.F...a.._;...w..2];X..30.0..)&.P.].r....h.v...h......0......H....E..z...g.[;.Z1...X...p.....S'..q.;"..u._.1S.2`..7.:.^9.`..+....].K...{g.'..24...B..}...H.M.p8..=.....Woa.L...j.G.....[:..{.=.".Y.G..q.......Z]..9 ...r.0p..)xea3..l$. po.Q.5".k?P.n..p.8..".VD.....R2r"uo..........{...k..c..6WU.c......FL..d..v].r.:.^y1.Y?..b...,...:.[.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\ledger.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2161
                                        Entropy (8bit):7.877690949768299
                                        Encrypted:false
                                        SSDEEP:48:Ldqsv/ehL2tSwGi7iMVTg4c0Tl7N6ByL7LLNGxwTNQbOt0wR:5qsv/eFXwGi93l7hXLNGxwTNRN
                                        MD5:1FE78953D56C84B4A21DA0E92D9DD6DA
                                        SHA1:1F7284B2B71574D7EA07AC14F826D1E929C99621
                                        SHA-256:BCED40406BB5BAFF13541CEB9FD03BBFDC485F3C0A14D39B5E56A1ADC021CC0B
                                        SHA-512:AFFD2D9009D92287D0E7BFD0D69670324218FC089F9486251F6A767D481FF1F8267A5D9C75803CE8215EB89DD71A60FDB9D7C40D3D74D0DC689E9C4EEE3BF8BE
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............sRGB........+IDATx..ylTE........i+...=h.......A......R....A.9..(BI.....QH.(F...F..(.h...T.@. . h....}Kwy.o.......k.o.o....7o...ioo...3..E......N.....+./.ztW.Z.)<......U............K...C...[U*...Y4...W..n......V....".w..9sm.2.......+.x...Wx.&.....0..D.......s..Y...bO|.{$.7........bj.!......_C.Z}$3...JL.....z..R.=..R.....!U..".=0.{.yJ..@..n'.ex...qJbE.(Z..{...?.W[...Pr....1.{.u..F..QX..gj.......p...9/..f.`!p.l).........]..f.J....0u.$.e......9n6.^.J..BC.Cr.h.....76....R|V?, Sj.7j. o.v.z.=:0...n7.....O...c`..wa..HI...D...I...P.../w.x..H?.[o/........'......~..V.n...a.[....!w.f..$A..` ..O<.......M.$..r-...).K...`.o.._....r.RI....qZ..L...I.q.,+..m.].....`..{....R........b. .m.......)......F.....nX.m21A.."..W(p.|vr.+..gm.C..F.(......r....H.Fu.....{..f..n./..I.....A....c...9q..x&@y.sw.VA...........2@..wH...U...<.C2@nd...<.Uw.P.(HMI.QO....a..Oh....*....w.........X.~~.0{.4.9c*...0.K{{.A..A.V..)........;g.,..............V@|

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\ledger_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2140
                                        Entropy (8bit):7.87248854648818
                                        Encrypted:false
                                        SSDEEP:48:Uu3Yfl72SkZGC20QjtVnna2KRjFhk6MAPV8s6UFh0RodtItz3B+JNnsyDOX:Uu3I72SkZ80+n0jMAuoYoCLB+DnsyDOX
                                        MD5:EC32A5395384BC89A92475046B5FBCDD
                                        SHA1:9B82B1F91E51C41AFAEC4605AF7B8551C5E9FBB4
                                        SHA-256:7AF9A6D6AE06198992E41CAD67DA0BA7A754AB8FA7309E7816DDE96C9F04BCFF
                                        SHA-512:1D3569BEF25216654BC7505327AAC3FB484275600639A9A9477BB4B200ECC71EB90FDB85AC98F9D3E3AAFC931C0EBE0E6636BDF50F3EAFE372A170E5E07FB962
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............sRGB.........IDATx..yl.U.....-.(.H[E.B...H............x..Q....CQB@c4....#....9...!wQ...)..............v..vhw._.:...{........Heee.....l..f.u.k..E.A......$I.q..y...F$.p.P....z..M.....$...%.....X....^...........1q.q.|. ..j.=X.....f.....Vx.&.....jl.@dp..V"s..`...jX.k.H~n.E..-..V#.e...FI`- ..../P..o.",x>:...:F....""...O.?..F.....K<......n9...`..a.f..8X.......y.U#..s.1......c.. 0..6.<KG.>..iy# .n...a.........i......$].q.jjTS%...4.<h`.2.-XB....2.."....$.#...=...../.`<..?,....-.R..Z...:s&6.......N.~O..eee.....]:.B.v.<.t....Izc..........t../..#..b..#I.L....4s.B.{.28&.+*+i..{.....[.f\..sS.....C....b..C.........<uZ...k.`.B.k./.S~.O.a..KJN.+...z.&...._..C..z.&.....W,V2.i.0.X...i.....0J......).2..._..z.#.0.g..o.z6Y.V..._c...FI ...Z..$.ev....(<..=w.......z.....w../....cN.V..6.u........(.L.....!...#Sg...y..,..........K.J.9.....S..).'......WTT...(.|........F..B#......B....Dj.:......b...3.cF..IE....-...C{.?w:e

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\lightning.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 72 x 72, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):446
                                        Entropy (8bit):7.0861494853353495
                                        Encrypted:false
                                        SSDEEP:12:6v/7TaeVxOaw1fQxEeW+k8C10a/AhiaOF3Jy7:9e/Y1fQ/W+a/Ah5v7
                                        MD5:78140684F45698CAE3761FB62AE349B6
                                        SHA1:9088299D1BC1ACCD8157FDFB2E4375D8AED05C0F
                                        SHA-256:954E52C6F49987DAF74AD9341C55874ADA731DEF069DD938842F170022AA2FC8
                                        SHA-512:C7CE40962A051F0CFAE9AA38355201AA4A34FFBE0B65E8CE0464D4015F2AF35A068E99BEFBBD68C947407CD38A93178B63FDAD029A135A43E3091A61AAA9AB0A
                                        Malicious:false
                                        Preview:.PNG........IHDR...H...H.....b3Cu...0PLTEGpL..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3H..%....tRNS...`.0. .@..p.~......IDATx..K.. ..l .&i}....y.w....hF....9".q.3>.....d....rz....LH...*-$.sq.M.4.....K...!..2-n.*W."4..B.....Rv..\..F5B<...ra....)..:"..Q.B......e..t.Y..Q.'....Q]..Fu....k6...F..}$W...,x,...C.......k.+....{.Y.i.bLHW..n...iLH..rq...;..JW(.r...*.R.&.QeB.U&.\T..CC..p.K4.B..v..%....c4.B..*.);.(.D...K..\>T_........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\lightning_disconnected.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):4825
                                        Entropy (8bit):7.953699430939302
                                        Encrypted:false
                                        SSDEEP:96:FPNGemd9jas1Vgkr+pc+kAVw5mOmq4/YfbtWb4wiKhAWvtSM4BEMZwGO8k:vSDjasQpp6AeRgobtWbUKhdvtSd2MBOr
                                        MD5:7F5BF4119481B97CE967C64DB76BE223
                                        SHA1:345C19ED37AC3D699CDF463A2048BDF9B2FCAB28
                                        SHA-256:B3139500B7DB13D25D1B9CFC29D5A1964934610C11250928658ABA4F16449D2F
                                        SHA-512:3DCDEC46C77A36446BA913A939F138BCC186113F55BD5C91FAED98EE52A2163A4E8E259C04363D840CB85DE39E1EA08038D4E16AE268086B7AF6617CD108E90D
                                        Malicious:false
                                        Preview:.PNG........IHDR...H...H.......{.....zTXtRaw profile type exif..x..iv$......>... ...=.....fI#iz..U-ev.$.%".r.?.>._.HJ.I.ZZ)..i.b.......{...^.|..\J..._..;.._/..3>_w.u'..@.}...lf;_...z|..y...sRZ....@...5...ay..u..(^Z..R.;........v.~..........I.5.............og....8?.......#N.y#./...4...............9.....u)x..2.:;.......Z..f..~....|.....Z.x.. a..N..8..D.;*..gL.ZM.[.D.h.'.....*..q.....m.w.v.2..<....^.......|.9.\.|}..vE.k..._." ....>.....c.*<fn.,....1r.+..s...)..t...E.1&$".KH9..5F..?V..<R............4.hs..l.D..6.....T.P'X"..Q..P.)K.d...{IEJ..h1..T4kQ.M{MUj..j....bK``n.i.....L....|..#..y....6.$}..<..Yg.}..0...UW[}..A.-;.u..v?..IGN>......WT......W..=..Q.S}."..d.......Z.H.h1.5.D....HQ..b.V...B.!...c.W.~)n.._.[.Y....9G....oDm........>Q}..X........">......j.7[d]G..|1.......^E.l..o%|K..>....g..}V..z.....9.xe..kZ\.U......N.]]k...v.(<.....V..][..m......P].m..Rg..J..*...c.L...^'..K...=.....;....g.....2G<{..$.!'.9..N*.. ;v;...=T...V...Chb..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\link.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 450 x 450, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):23125
                                        Entropy (8bit):7.913567993722842
                                        Encrypted:false
                                        SSDEEP:384:xBKjOrHWERCVV85p5iKzimD9MX+sbAwhYGAEP0ILW6DpcKDVq497mqysBPSEkqjy:x58Q5p5iZmmnbAqYGZJZDF9iulLG
                                        MD5:95CF2F586590A039AD6A410B52F51D94
                                        SHA1:F5ECD7EAC202F50BBD779BF2848037C1C3997D75
                                        SHA-256:F9DB3A8E50FCB3A75C9E9DD5BAF45940DC97B7A3297FB0453CE3380CAE86C583
                                        SHA-512:FA6E0E2508988B56F9BA9C81690CDE1D9B8960EC86B6F7B9A43A533F7A04B79E0D57A58974D210F614F0DAA352F849286F2254336D2D35E66D5FA413C25EAADA
                                        Malicious:false
                                        Preview:.PNG........IHDR.............K.9w....PLTELiqb.C@..9..^.??..R./i.F\.;9..7..`.@=..7..:..g.Hd.Eg.HP.-7..9..e.FJ.'M.+Y.8L.):..g.Hf.HN.+@..L.)\.=J.&X.7[.:8..E. E.!a.A_.?h.I:..>..f.G^.>Y.9g.HT.2T.2J.'`.@b.B[.9].=^.=`.@...6..N.,O.-D. P..X.7].=E.!\.<V.5W.6M.+Q./^.>_.?C..?..9..Y.8U.4F."=..@..T.3[.;>..<..R.0>..`.@I.&J.'B..L.*:..S.2@..Z.9G.#=..Z.:K.(S.1H.%d.E8..A..e.F<..Y.9G.$A..c.DZ.:R.17..L.)a.Ab.C\.<6..[.;K.)f.GA..[.:?..;..].=H.$I.&;..H.%X.8Y.9;..a.BW.7F.#B..b.BM.*B..Q.0:..T.2^.?T.3V.5J.'g.H_.@?..U.47..S.2J.(`.A8..E."G.$`.AK.(^.>X.89..R.1c.CC..a.BF.#L.)h.IN.+8..V.6Q.0:..\.;P./C..@..7..b.CW.6U.3I.%D..<..d.Dc.D_.@M.*O.,e.E].>d.EP./f.HO..D.!6..>.....O..e.GE."9..E.!............|..........k}.d.....W.7............y.`s.Xk.N..v........m.Q....a.Ba.C..qf.Is.WU.4X.8Q.0\.<\.<e.H^.?S.2N.,V.6q.UZ.:M.+\.<.~.....9tRNS."".N5.....4O.c.c......ds.......q.................a.B...V.IDATx..}{L.g..v.:............d..c....B@n.......p=@. . .. ..H.h...zWl.mZ...cg..v.;S..v.i......;...C6|.}....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\lock.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):40380
                                        Entropy (8bit):7.964394337432647
                                        Encrypted:false
                                        SSDEEP:768:+ab4sv7U2pM2a7u6BurXDFEcaaZk0hLxr+G/uClVkAHChcfJoBfZ6m:+ak84qM2QF4rXDFsaxLxrt4AHChchoBv
                                        MD5:34DC98521BCD82497EA0ABDA704CC73B
                                        SHA1:81DBD99712040045E5CE3CB5FB36E8E7DFAA720D
                                        SHA-256:91012C141285680812ADCD9EEDC663A38C1296FEE3709EA700F48F55F5400493
                                        SHA-512:0FEFDD6685928FD2C72E5427FDA0DD65C3AE1AAA40B6232C7A20420F225E778AAA60D7ABF24793DD16759ECAB0CA9597BE10F4A057A2636A8A275DCDFD0FB867
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx..y.5YY..{V......#...(W.A..b...nQos...1.....AI.."...... t+.....{..D.Z..n...~...{...?.V.Z5.]{..O.}..}?...U.^.z...A..]...x......;....+.e.G.ZV....#...W......5..GD.........'.ufZ.x...+.u..:..5":..../...{e_.A8.P........J..PO!....7.|.......\..z.....y...8O...:GJ?...G..<...\(...........7...\.u.kY...<...0.)....{.......p.f..D_.>...7..r...Ye.V...#.....o....,0....b.Y.]]v...g.|.L.%.>..}7...._....e.L..:"......^\.......z..o.p..r.(..|......Z._..o|..B..^C.X8......B.V..]..'.|=...O.<A.....+......WVVt...2.......++.z.....O..>..QB9\$.k.G.W>|.w.*.@..........]_..!0...|#.Uv.....}..)1...o..O...](A.6"...m..m.W|.A..`.. .........?.......J.....4..I.....j....A&z)..C....)&..f....).0.0I...f._..|5y.3.........n..w..u?.X.....".,..+++.f...2..............].....t.).*".....V....K.x-.];...>.LwW...-]f.......y.;.zS..u.....e.G.l...X..w..Ke.F.. .,.Y.l...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\lock.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):12125
                                        Entropy (8bit):5.044141834443952
                                        Encrypted:false
                                        SSDEEP:192:m6Jekp81JeM5I+sUwu7IStmwNvyWMd67Of4mKm+jZLKYx6:m6MkCX9Cr7u75tVNvPOfTR+4E6
                                        MD5:DF4B5D8065ED9636F912AC1FBEAC3884
                                        SHA1:98A87B2D66CA68592DA2E21DF2BC12029FA19342
                                        SHA-256:DAF51089C0614450482A65DE2A5CDE0303B07C3A3DAE87BF011466A91ED4140A
                                        SHA-512:02ED73FC39B111672A92B87C4E8CFE86A2E9DC826451A4C3BB043A5E2777F6EA8079CDF887FE27900184DA97C620E349FB2ACE3C0293A8E307977E3DAEDB382A
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->..<svg. xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". version="1.0". width="512". height="512". viewBox="0 0 22 22". id="svg2">. <defs. id="defs4">. <linearGradient. id="linearGradient2411">. <stop. id="stop2413". style="stop-color:#fee7b1;stop-opacity:1". offset="0" />. <stop. id="stop2419". style="stop-color:#ebd4b4;stop-opacity:1". offset="0.25796592" />. <stop. id="stop2421". style="stop-color:#c8a775;stop-opacity:1". offset="0.50796592" />. <stop. id="stop2423". style="stop-color:#b0935b;stop-opacity:1". offset="0.74009573" />. <stop. id="stop2415". style="stop-color:#fcebbf;stop-opacity:1". offset="1" />. </linearGradient>

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\mail_icon.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 65 x 54, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):4548
                                        Entropy (8bit):7.940902601053362
                                        Encrypted:false
                                        SSDEEP:96:B6MC1mfxQGFRS5VXbT/yeTEd0YaUnPj0WZqbvYm5WkK/cm:BaomgRSfbTdQdnNPjCLN5WD//
                                        MD5:AA97731F75066BCEDDE8077F4AD87430
                                        SHA1:7340910D7E74C2FFDB1830358EE7BBA823057CBC
                                        SHA-256:D603B32D4C331092FE947B1D2E9AD43E7D701436B539DFADA6FFD85838DF8699
                                        SHA-512:77E793266A6F947C9C37C1BC278F03A63627D3B1E93D5025F1964858AB6D132DAC33E054B75E1210096DEBC29620546448722B9FEC46DBCB003E3A7386E5451C
                                        Malicious:false
                                        Preview:.PNG........IHDR...A...6........<...AiCCPICC Profile..H...wTS....7..." %..z. .;H..Q.I.P...&vD.F..)VdT..G."cE....b....P..QDE..k..5....Y.....g.}..P....tX..4.X....\..........X...ff.G.D....=...H.....d..,.P&s...."7C$...E.6<~&....S...2.....)2.12....."..l...+...&..Y...4...P.%...\.%.g.|.e.TI....(....L.0.._..&.l.2E.........9.r...9h..x.g...Ib...i...f..S.b1+..M.xL.....0...o.E.%Ym.h.....Y..h.....~S.=.z.U.&..A..Y.l./....$Z.....U..m.@..O. .........l^....'....ls..k.+.7...o..9.....V;..?.#I.3eE..KD......d......9i...,......UQ....h..<.X..d.......6'..~.k.hu_.}.9P.I..o=.C#.$n?z.}.[.1...h...s.2z.....\.n.LA"S....dr%.,...l.....t..4..0.,`...3p.. ...H.....H.i@..A>...A1..v.jp..z..N.6p.\.W..p...G@...K0..i......A......B...Z.yCAP8...C....@..&..*...CP=.#t...]..... 4...}.....a......;..G...Dx.......J..>........,._..@....FX...DB.X$..!k."...E.......H.q.....a......Y..bVa.bJ0.c.VL..6f.3....b..X'.?v.6...-.V`.`[.....a.;.......p~..\2n5...........&.x.*.....s.b|!.........'..Z.k..!. $l$T

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\menu_vertical.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):997
                                        Entropy (8bit):7.21865102763374
                                        Encrypted:false
                                        SSDEEP:12:6v/76q22Ox4+s32iWfG4yCDFRbRkUWoFulndZf+awOPvY2D0Vfk2IZv0Ake2Z7nx:V/Bs3wG43FP+Df+awO5D0VspZv0Ao7J7
                                        MD5:52379D1219B147DAD4EAB4DD3916BE89
                                        SHA1:068B1EAC1A6484C2C25D026917B94D4120E14565
                                        SHA-256:E6ECB30EE42657FF6449AE801B32599DE79BBAFC4227A6F1E6CEEAD690A1D672
                                        SHA-512:C6B96A9E9BD69DA68F89E4EA04785D2FEE574D278C120B0CEF1134E5E039B3CFAFB5DBA4354126817BACD45E6A776222775D0A70AF26B84FE97257B1040D2DBA
                                        Malicious:false
                                        Preview:.PNG........IHDR.............R.l.....bKGD..............IDATx...AN*K....#.....2.G..6#..u...a..........PE../.i.*..4....................`...,..&.&.....^.ao8I].U.......,.,8.]......w=E.8!......P.d..U.W....J2/p.I.......$....$..r......K..M.Y..0..$.*f_T.....r..p...h...4..i.@....).MS....4M.h...4..i.@....).MS.....m*f.V.....b.{..IP......+fC..cQ.....Z.|......WX....9...K?..C_...?'k.....M._...m........................,..&.f.`...b..NR.d..;.......dtI.Sn8.S....J..[.EN.{....y..M..H..&.B.,.u.\..-....R.|.vV..L.&......'A......;..o....4M.h...4..i.@....).MS....4M.h...4..i.@....).x.....'A......^1{..`.u......X.....)_.."'..t.......$.EN....+<...W.'....'.K?.j..~3.u........................$.$.I..?.k;......%Y%..qG#..,8.]......%...R....C....5. c^.|../..I2..;Kr]!.~yK...n..8.......I.b.E..IP..~*...G....).MS....4M.h...4..i.@....).MS....4M.h...4..i.0.b.g..IP..>*f.W....o]1..b6$.;....`.e.......].q....:.y..........:......s..I.....d....{..;?.................0a..5...k.......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\menu_vertical_white.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5565
                                        Entropy (8bit):5.489309030569267
                                        Encrypted:false
                                        SSDEEP:96:5uURgCETmGA0Ok0IBEoPlat2DybcSwnLVpe3wLKpe3wLKpV:5uURgo0Ok+yIGy4Sw5gAGgAG/
                                        MD5:A9F45868EA789C17608B8AA7CFD0195F
                                        SHA1:D2F573015718D8A10C3C29E7041BF8215D312D34
                                        SHA-256:A492B9E638F5D68D304854B2D683B9B587427CFFDCCABAEB27EDAE7C4058760D
                                        SHA-512:E573D2FBE7848286DF6D959481164E94C4FE33EFCB2AAE0199B5579F883C1BB1105DD2D7F13C2F61BCD2D555927367E64B3E0CB97F5521EE008D32196E16E1A3
                                        Malicious:false
                                        Preview:.PNG........IHDR.............R.l.....zTXtRaw profile type exif..x..Q..(.E.Y.,......`...f.s..O'...3_.*..,.E..I..._3..D.K.j^j).R..rC.3.U.W.R....dOw..$..|.r.....8...~..K.../}....(........A.@;.....u..q...?..E.g.....7....!$.J.?..x8IC.P. .(.(J.....wq.S.G3\.o.=Q.[..^ie...K..]..'.....3g.Z.l79.....x..>.....B].E=..Z..c......fx...rEv..0..w.N...&e..h..N..f>....e.].+w.~92M6....]`...Z...5.c.A...1.}..~..9.(.m~..~1G..F....@...T].~...\..5..G."..).+.{...-....3H6....S+.....j$J.6c6".....u..;..*.8.Y...sL.......s....H...9...X9+..e..j*.U...k.V...+q)6......Uk..]...{.V...M..Z.Zkk..A.....Z.y.=.....{.[...k/.....!...(..:.A....=.a...h.[mJ.y.,..:.M...-...].x...vS...!Aq.h0.0N.@...64...)g.r.l..S..'5...b ..b..`..$.....d....Wr)....wn...Ne..S.A....c.;..]..N...i....}.>B....G........_.?e.. bJ?....iCCPICC profile..x.}.=H.@.._SKE+"v.q.P.,..8J..`...Zu0....4$)...k........... ......"%./).......=...B..T.k.P5.H.cb6.*._.D/...(1SO..3.._.........9......H<.t.". ..t...aV...s.q..H..u..7.E....62.y.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\microphone.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):199
                                        Entropy (8bit):6.502673009329309
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPO6xshxyT1I3JQilfevL5xFVs9Q2lbp:6v/7Pxsh4a2FvLG1
                                        MD5:1986AFF717AF895B8B22B8E83A8DCD8E
                                        SHA1:1B085C4ACADDC63D6098DBAA2F10831F7275FA8B
                                        SHA-256:EF6C6AA285EB18667D992D916DCCF2337FBB98B07631DE8EFBCBEDC24958E347
                                        SHA-512:F5DF9E8616932B0F879046BBB2A8FA4E534EDC77E59D3A2B1058DA73C36AB20E126FCEC073034CC64414DD129D554B64FCA403E6F49096E29B63EFF015D3B3BE
                                        Malicious:false
                                        Preview:.PNG........IHDR...............7.....IDATx...i.A.... !5.... .......Cc....N.....@E..=&....O...AVU. .M.d.....*...@.T......n.....n...x.|zw.7~...f...jk.l.!..O...k..\.h.).<...%.._&....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\network.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3031
                                        Entropy (8bit):7.892998440069336
                                        Encrypted:false
                                        SSDEEP:48:UNpK7kK53XJ2tvzTuqKyRmuY5yQ8QdgLPclW5yUQobw3Ha+qpJ6jInqd4JihEEs:CkFpWvzCJuYk7QiDclWuVHapojthxs
                                        MD5:56802ED77DED3282C7E1133403AD809B
                                        SHA1:211F85B6B9476DE56709B542E2C8715BF2F3C16E
                                        SHA-256:42D7060EA7B16E9CF8FEFEF098A56A77616E595BADDB5DCD353242A1C07CEEEA
                                        SHA-512:FE10A020FD519501CF7EE9B7C7E36DDFFBDD1407B07D6AFB44D048AB3D30662BDE1884F248CB13983CE0D55622FC561431F9825DB1C03605E0663273EBE12036
                                        Malicious:false
                                        Preview:.PNG........IHDR...0...0.....W.......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....tEXtTitle.Computer...v....tEXtAuthor.Lapo Calamandrei..*....IDATh..kl..u....;..R$E.T..zP..n.$.%Q..Z@..q.......N..ua....}.h.~(....>.....N....T4..t[.p".1..RRG.dZ..Dr..3..~..KR........;;;{..<~...*......./`....-*..H.@....]>..@.{EC ...Cq.*....4..o..{....x..H....?q......0...w..c."..A.D.b..j......-...}<...|N.=>/..k..U.^....F>.\..F.aJU..j.n..........y..c..?M.jV.B.0A......B.8.s....w....<(..srf.U....P.H...gY..|..I....+#@.0...3..H.8..ZG..*..,42...X....P..E.....$)!\..1.a.l..h....i...<.r...3T.r.H..b.A!...%... .2.f....Y...%....kq"5&......Mr.....L...t)..F_....H.........}.6r...0FQ.Q.Y.....k.4(ij....c.l..|PE...0..F....h...".....}}QY.r|....<..9"..j.,..J{.Q..E..8...V.A,d.21q.......P.....%..Z.../.3kx.1..RN......|.......k.....8.l..x./<.K.i..J...F...W.,W.(...8.PT.V..).5...@.j4%.#....@...T.... .B...J...9 r.h.^I\.....%..*"...4...q...W........D...T.fDM...!?C.U.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\offline_tx.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):463
                                        Entropy (8bit):6.995233320421183
                                        Encrypted:false
                                        SSDEEP:12:6v/7kYiUpZhKeAAthzDyVmlmLVOqm2UKx34nRP7aW/GFQHN:UiUpqeAEZDyU8ROBz838P75dN
                                        MD5:51FB191EA358A072A69F92E4D5278D54
                                        SHA1:2A782A97B00C2BC64669AFE9FF45F0DCDB9B11B9
                                        SHA-256:81727605617F1CDF8A77D48BC554A080555730969CA261CB669560D295B4D65A
                                        SHA-512:B5BF8270536BBCDACD6C89C54ABFA88D0307FD4787638A06625AACF9F6E09A3F0A45F466F2F2062D0F15BA04132E4847A5C1FDF0AE36484802FA85DA76D078EA
                                        Malicious:false
                                        Preview:.PNG........IHDR...0...0.....W.......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....LIDATh.c`...`d.Ft......a.....f..0...Z..\...d..`.m..C...10..4+.De.R....fR....|...J/h$.E8....X.o..<'.........F..@..<0.`4..4.....F..@.Q..4...@.!....(..W'..`......IIHK.6C..N.....u.=...P..v.6F....|......I1....AX...........r.E.$.02.C..2.B..4...u.!4x+...#...x....zr...?.C.es6....<p.*C...E<.bd`....@...c)$C.b.Ud.,i......`......2.L^...f....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\paste.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1309
                                        Entropy (8bit):7.792147582960006
                                        Encrypted:false
                                        SSDEEP:24:ygJEdhS85SSGg6Ay9BNVQLVt/6tw2YoZ5leNGR1+x1BOTlcti8imX4tQGIIgx4aL:hJCt53GJ1GLn/6tmoZ5leNGR14ulZhmX
                                        MD5:04BD3B83FFC3260171E9A6116DB5CB8E
                                        SHA1:EADA3DA9D6BA77A991A4BC14D8079C315C655F21
                                        SHA-256:64A811C29845A9B15BD87D8C1751ED55D075548F5F62852BF21602248DD8EF8A
                                        SHA-512:A1C24D6D3918A1F215271239880AE1D220E7DD69A5C75648BA711D2CE82707AD07AAB9F0C2F34F68CA46E46E7644115C7E4CA248165AABC009590C2F30B1F8C8
                                        Malicious:false
                                        Preview:.PNG........IHDR...0...0.....W......oiCCPicc..(.u.;K.A..?.E.A.-D,.P.0...Rca.D...f..$B....Dl.....h...h+.*..".X..|5..;.. q...qf.e....y....`yNr2../,j./..B3..t.....;>.S.6.z....hI...uM.#..x.c.5.V.-.a......#...Rz*.g....;......Z..SUl.p.pO!_4~.n.jZs3R.dv.d.8.)....#*..j.b?.)V.c..f.G.Yr....(]M...M......f....qhx...^h.r....|.|..G..*.U.i.C.RE.9..&.]V....oA.;......d............~.9....y.k..>..Y....h....Q....pHYs................TIDATh..Y;o.A....m..%...H..d..h...H....."$*J(....D....D.@TP .!B(...B...'...|9.w...rWxg......=.e......y)%...+...S...-@.b.}...l..@.q.......q~.N...@..@.I.b.D....hs3.KQ1c;fbDrcc...C..?..$........Z...p.....['..z...JB\#.&..A_.5....oa.U......*..e...,..iuu.U*5%.`j.....MN.I.t..o.s....0{S......Jr..c.K.c.~..J.c....v.. ...=X.......H..`l>M1.3vX6...2j0..j..r.8~.S.6.w..6...8.[lt........90.P.9....|.6....E=.....@.<..C..x7m...h6wY....P}.6ph./.i..L../...|(;.{.|.P.......9Z......c.N...m..E.^..t..o...l!...8@)D$pT.\H.;.@.v..;.....Er...id.B...U.~h.Uh..g...C.z.b...C

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\pen.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 127 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5625
                                        Entropy (8bit):7.863385035645726
                                        Encrypted:false
                                        SSDEEP:96:ftQcpmstcPvvR0gTRowipcQJGWoCxQJOQJHVLPZoonkswWHc9:FftcXmkFoG2VexPm5swUy
                                        MD5:239AB6E6F6A28BBCB05D713E045BD0AE
                                        SHA1:44D5F007F7EF15F5A7394E893BED9A69920CAB1C
                                        SHA-256:67F080F04A2248CE33741987DCB836AA5B99FFF9F93CCFB2F1A7DB54DE45DB31
                                        SHA-512:BB9FF9BEF96D3FEF1746AAB73F9AD48612E1523CFCE805135A146E5CBEFA45386A3F1ADDCFFD5ABD83B5A1630A596F572D5DBDB5628CF327A5F759142932ED1C
                                        Malicious:false
                                        Preview:.PNG........IHDR............."y......gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs.........O4....IDATx..it\.y..........,.@H[l..S..$e.B.r.!ml..h.n......R.....$.9m..&m.f9.4.I...v...<.l#..I#/.f}..+....W3......;.......W....1MP..Y...n.n.V.W.M..$.1`.8....9pB..S...<.....QK..&.g~5...}..4p.............../.$.<...?O.~....a..J...g.{...a./;...|....,P._d.M..R."7._B..@..b.x.xP)5h...=.n....f.M....|..:...?.F`=p....P..M]].D..X._$.u..........X.l......'.Z.c.lo../.2...-.T....@....qS6/.nV..!........u..V.i........W.Ge`.}>...h..i......".."..S#\..,".....Y....._...4.R.....<.n..B.X....K.p.;...MM4....A2.b<.......$22.X,..#l.-;....O.92c%...@.5M.@.8......a.*.b..[Z..F.k..$...H......i'...-.`.?.....3@=..@..I........r..u|`.jZ......>.`aS..Z..EMM.2.H......F*...0"7\V....R..I..8.......Y.pa^.......,...V.E.L.......V.U..#.;:..P.?.m....o)............q@.gIK.[...tz..7....H.......c(..<h..T.c.(.~?+\.......q,.e<......x.8..w....zB!....N.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\picture_in_picture.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1519
                                        Entropy (8bit):7.346859617844218
                                        Encrypted:false
                                        SSDEEP:24:Vv8FhMrsQe5h9j9GjW2FT/0FEPOcahAAAAAsnAAAAAAAngWFvIRYmmUlkBOXc4J:OFhMa5h9j9oPt0FEPOcuwgAFmDkBKc+
                                        MD5:A237060CE839D930C5BC4C31B929F5E4
                                        SHA1:5F999A8B7E54E606D9F12DA7D9BC3210EF1B299E
                                        SHA-256:7B28A4E860A10C693B44D9B7E12E8A45DF7F21139945308D04291CF12C4030E6
                                        SHA-512:4A1EF9180C35422A7AFC1AD24215D6ED1F35D0602C97E4AC5677167F4D8F4B465D5A5E75CB7CEB4AB5A505679FE90077B88D5286F2DA271685F2987A367D603B
                                        Malicious:false
                                        Preview:.PNG........IHDR.............R.l.....bKGD..............IDATx....k.u.....{.......B.."..0.J...h.F.d7....A.B.C..u.T.iPH.r...)....MH,.......9..r..........9.......}7................W/......[.F++e..d.j.<....8`*...A....Oy....Ff.ZW....}~.il..6K.W.'<..F$...;.cM;W.n...i...._/.l..E..3..4.I..zu.......N...._...Hj...@1N...[.z.....-.U_..S...(..5V-m].a.<:..G|^...[RwC..../.7<...L>...>:.m-#.O%.*d.P.ojmy.v...3.....:RyO.....]......}.(....v.....(............>.udi)+......v...{I.Q....T*..'?.}s.J/..0I.{b.N.......V..,m>..;@M...@J.m.$......&.....HK...V;..x.V..L.@.%@...wf&.H=.HdE&yG..@.v[&..3.4|A&~.F\.3M....$..Gh........Dr..OgN.S..<.qyC_......?........it.|........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B.S..d..whl..z...@.n.in....o.... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\preferences.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):58005
                                        Entropy (8bit):7.981001133922237
                                        Encrypted:false
                                        SSDEEP:1536:+PxrzHqcm39TBsFQNUX7TYIUh3lD5mIuh8/f9kH:+Ph2cm39dQQNUYIUB9BVFo
                                        MD5:0BDE10EBD19F36D720C2AC4CB23C75BE
                                        SHA1:F8D92A3FFC02D6B655021E7366E1E4343CD2E4ED
                                        SHA-256:D3D4163A8D6788F78D2C2AC56E261FE506F4915065EC488F79F858C7CA13C2EB
                                        SHA-512:844CF68A308B5A3A755714249D7E1A4F65264114EB2BD5BBBE8C190393E25E799A39982BB1F1EE1CBD2F7D1E351F16E6A2088AB2F6387D17FF3BFD8CB974C120
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...w.....NUu.I..(K......P........w.w...z.B.wg..!.k_s7\.]{.7|..i..A..l.ec0A(..&..X.............k...NUuuO..y.s.......`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`..2.'..-O>.d$.J%.!M.....$)..@$..}...N.92.....x..|%&..*.....R..`).e...h......+.......tS.>..>..c..!*...|....~....1.a..Cv...@.....=..w........t...8@...%.....;v.....`0.3.&.:...S.F.K.O..b+......+.@.....@...........c:..<Et>....n.p..M.....|r...'.....~C..S}B...1.`..D:;;..X.&..;Aq3..T.S.8......a..v.v.O..`0..L....]..R".9.;0."]..B)..|L....u.M..0..F...<...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\preferences.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):27175
                                        Entropy (8bit):4.978296915866158
                                        Encrypted:false
                                        SSDEEP:384:MxltEaE11Es9O5cuzJxb2GRbz5nKbTqggjNRnx6Vhr9SC4cudg:Mxlt69CX7bDdz5nKbOgsHxu9SC4vdg
                                        MD5:5AE87DA02D4994C81EBED270CD45405E
                                        SHA1:47BBB94DE7DB651BEF731D915336254ECEAE9085
                                        SHA-256:8310F15BB417931A99FEA8EC0ABA6437C422A007BBDDE088ACEFF605718AA854
                                        SHA-512:A0B849E22842F931F0C4998B36F353951264857927BB17DC894991AF88BB05271DE623F75E054481BEDE80048DBC21EB224AE7951319D40E313192FD7B9CF755
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->.<svg. xmlns:ns="http://creativecommons.org/ns#". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://web.resource.org/cc/". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". width="512px". height="512px". id="svg4289". sodipodi:version="0.32". inkscape:version="0.45". sodipodi:docbase="https://commons.wikimedia.org/wiki/File:Gnome-preferences-system.svg". sodipodi:docname="preferences-system.svg". inkscape:output_extension="org.inkscape.output.svg.inkscape".. viewBox="0 0 48 48">. <defs. id="defs4291">. <linearGradient. inkscape:collect="always". id="linearGr

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\qrcode.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):314
                                        Entropy (8bit):6.8331753934323185
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPVjnDsp5BAAAl0hy2YxsDEIyFtKgcOsxq0j9/Iov5Fgo4G8up:6v/72RAAANmDlyXKSsxqigyngo4o
                                        MD5:5B142F2315C1878A0A13E5B0112CF477
                                        SHA1:44FF82A1B89C623EF19F4CE6DC51BA5916F8953C
                                        SHA-256:874D11BE3C20F635845464AD2E4FD1866D1CCFA3793E51C6BB0466433409A75D
                                        SHA-512:593793B1ADB885C025FFB5D675B9B290C961D6F542E87BDCEF3A6E7B28372D45E55A63A081281FE4477E6F180F3758ACE67D1BEE0F5300B563351B8DBFF50FA9
                                        Malicious:false
                                        Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.%...@t#.k.....,l..... .@x..F.."..g....7..............a..X..$.O.,.q..P......vC12{7T#3.8&...}H4>.>4...hQ...B16>....Q,..b{$..P1.....'.l>I$..DV(}........h4..Fs.m<l.. ..... ~.%.@b.Hr...@..JE.@.....@.. ....;.".......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\qrcode_white.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):380
                                        Entropy (8bit):7.010361133917859
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPv19s/6Tp0jt2jsNcgzwHunoxxrBd9AYQOYuBSE8lGEUHZo8l/jp:6v/7js/6Tp0jmPgcZJd9pQOTBildsH
                                        MD5:80AE0CB6EC943BBD3ABFF1EB25DF4AFF
                                        SHA1:1BE471FECA3CF83842034E07F419FBD8A62EFB8C
                                        SHA-256:BF6ED6E043082EFAD7B047B7743FC554DE765BE504E2F949F326AE1418C40706
                                        SHA-512:F9768E970731B736AB9BBFCB912E0D692DAA95939C26E416B2B754B2D9A375ACF8DAD7472A22FA723E9CC3E6E24AF1AE21392F1FCA8FCC608812B374D025F686
                                        Malicious:false
                                        Preview:.PNG........IHDR................a....bKGD..............pHYs.................tIME.....6..}L.....IDAT8.S1N.A....It.i....HA.DC..x..?..D EBJ."M:*...4c..".JV VZ.m.k.."..9ff....<;H.Jzly:.$.afp.'3C.Ug....d..@.s........H......,i..H..u/....%...W.5....<....o.{<......W.:.+...u...9...&9O.c.........i*U.Y...m..%y.......u...1"..."b..!".fvZ}.G...;........,.._$....K.O....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\question.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2555
                                        Entropy (8bit):7.903707300768179
                                        Encrypted:false
                                        SSDEEP:48:SGVuz+yQjPAlzgOkNeRYpi5Utb3deYhwQBySsRfC36iVMCekiFfeq9p46HuP+q2:RTyQzvOkQ+rtkBQBySlqiVPe+q9oe
                                        MD5:AA64EE12B7213AA1FAF0177F513248A7
                                        SHA1:560838B563379CEDBFEEDB38A8B234E67CB9D0A6
                                        SHA-256:7131F304F5152243660964A0B97912E13264E8B2E8BECBABF58ECE964F6D06CE
                                        SHA-512:515E66DB60166BE9A4883C2AD734F5EE1DE187A1A2087FFB03D9D0E619012E289B4C91B27B90C889E976D20502C6CDB85C10EC889EA63532790356E6CBF0DA17
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...2......?.....piCCPicc..(.u..K.@..m..t.A.!C..V..8j...)..U..B..K..W... ..k.?.UpU..E.qs.."%.k.-.py......w.?.3..I....l*)....;|.C.SH...2.4...#US<.E..u.c........2.;....-...G<.Jr...8...BW<~.\..K0.e....)..XicV...$q..+.y.q..j.,S..5..Y......lB..8e.f..h..P&....*89.(.7Fj....5.U.tT......f...$....@p...\...u.g@...6[.2.i..ZK.......)....0.l.\nH.Z~M.>..p......Y5.q......#`..#....h.c.......pHYs...M...M..9`c...1IDAThC.Zkl.U.>wf...n..].Ph.)Ry.Pjb0Z...|.S...6Q.....$...?CH...)H...@).6..PyH.....v..3.z.....mwg...Rv..{.9.|..s.`..YH.[._..Qi...DBj.......F.(.^..(.s..j.{..7...C.k(..D.^..[&.Dq9...+.n.Z.."..Fd....|.P...Z)e. .w(.?.....x..(c@.#[[.oGK>AC..NGxYY..p...r.@..\..%..)...........T'...m...@...T.@Z.w...|...+/.5...|4.x.~.;.<....H..L~...O_.Dg.@....bwd.'.._\.V.V-....2Yk.k.. \.y722..)....{...s.2.xAZ@.;p..n%.....W..,-.OG..k.....?...e......gF.S6/..?.\a...nwvi.*.#.6....{ ....$./8$........K.@^8|n%2..|w....(..bd.Jd..........~...?.)....T&........H..:/].2.."

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\revealer.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):272
                                        Entropy (8bit):6.2770460901246015
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPgNQV9Bm4dKcXtrX4C6MaAJoSYMHrSkPtWGiKp:6v/742LZZX4CnKMHtPtfj
                                        MD5:EB80AEDF5B34DA55D8374BD64C31388A
                                        SHA1:657C580521EDA2F1950AE2759CB282E802A5726E
                                        SHA-256:F71D617A02018D8C805A7E60FD297CA1C133D83C95FD52FBD557DE4BEB337297
                                        SHA-512:313B215288B72B9E75F71B0F21BCA4C64611DAF2AB7E8C1B42E3C36FFDA78981C5D88695285DB4CBD4304E2720947DBBFAD001E2BEBA7392774D238E846CC1DC
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<.....:..r....sBIT....|.d.....pHYs......... ..|....tEXtSoftware.www.inkscape.org..<.....IDATh.....0.....5.l..1..V.5l.....}.<r.]j.[...7.....5....3..`:....3..`:..j.....\Y.1.....3..`:....3..`:......i...U.{.].`:....3..`:....3..`...b.8.. K....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\revealer_c.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 510 x 510, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1965
                                        Entropy (8bit):4.837695335858453
                                        Encrypted:false
                                        SSDEEP:12:6v/7PtPyHAxS7jTGECKFOFOtnFOF7FOFOtnFOF7FOFOFAFOFNe4FOFOFAFOFNe4d:KyHAxwvGMeee0MGSqeeeGZtaeeeCa
                                        MD5:6546779DBC25E0DFB2F935BF96BC5024
                                        SHA1:C0CC2CEAB6FC52683A7460C365D0B5E42B24AE03
                                        SHA-256:E5402C2963B446F93E667631C3777CEE9CA14EB60D8943C83EFC6707DBAD73BB
                                        SHA-512:33D7BE6D78BCE54FA6454E6DAC33A6B1ADA26E29D299BF159EA3064D8405AA6B6BF9E4483BE1AC95E0E6798E51216A9E1653561DA546BC31B0A1C0F0836E5F9A
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}ol%....bKGD..............pHYs.........B(.x....tIME.....-.#.b....:IDATx...m.P.......A........#.....;/....RP..oFp$K.s8g....t.......7..........?. ..........?. ..........?..?. ..........?. ..........?. .............?. ..........?. ..........?..?. ..........?. ..........?. .............?. ..........?. ..........?. .. ..........?. ..........?. .............?. ..........?. ..........?. .. ..........?. ..........?. .............?. ..........?...j...a.RD..&Z.VF.Y....j.&]..C.D..9.N'C........~.@..........~.@..........~.@..@..........~.@..........~.@.............~.@..........~.@..........~.@..@..........~.@..........~.@.............~.@..........~.@..........~.@.............~.@..........~.@..........~..~.@..........~.@..........~.@.............~.@..........~.@..........~..~.@..........~.@..........~.@.......7...?. .....&....H}...p..1..Q....3....n.[j......w#,@e..........?. ..........?. ..........?. .. ..........?. ..........?. .............?. ..........?. .........

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\rocket.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3869
                                        Entropy (8bit):7.9449346827433525
                                        Encrypted:false
                                        SSDEEP:48:+aPMsUHEPMD+P2oaKky+FAVNoFwA9ZZ8kOF+2wZGifY4egixgAkJcNQ0tqkX0:Gske75uyMiAXZiFMzfYgirnNQeq+0
                                        MD5:E23FA5FEBCA81A2F9D4C131F7E9F5120
                                        SHA1:7F4C2A9604A5A3E800E7757DB91178B8FC6ECFE8
                                        SHA-256:F8EE64F59312C356D1EEB4164F746646398FD5F8555DD30A9A3744725C136891
                                        SHA-512:1EDA81A435CC2BF4AD358B27A50B4CFA241FBAD7F307792B34E64491FB26464FD015EE672201F2B58A590501F789F403BD4152367D20F60AD083DF65C0FAFD93
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....pHYs...........2.....tEXtSoftware.www.inkscape.org..<.....IDATx..y...u.?...;..."......QRA.Qh..jLj.4..JQ.hc.U5iWC....f....&..Wl..:.T...C..E...".S|...M..\.p.7#......g....}..g..PJ.........Kd..s...M.01.m.k......>.l...."..V..O.hm..Hvj........~D.s.`..|...'G....-....w..BQ.P.-.&..d....i.^ln....&d....Ig..........I.@R..s.....?..l.+b.........?m.8.{>.....$t..,.)...Q.H+..."...f+..n2.v.p2@[g...).6.....d.......q. ..T,..3C........)..........46A.ki......$!Y.(!..}..'..o7... B\^%..P."..!.).R.{.J:.F.+k.HP.:l..:g......l.{.&./...2M.E".......-.]I..UyBGQ..@.~?..I..m..[..X!.UKn...H.!j;y4d1.>./]Y.......@...*...lzg..h.@]P%..p0H(..WG.`...q=Xq...O....(.TI......'R*.eg.\..9`r.LJI<.A7.......l...........?!..W....c3..c..=.....S....x.`..2u:/.3.......7.]....7v4-E.W......A<.C....G:..-I.X$0k6._w=...K>.1..... $..V.,......0L.C3.B....q.<.@.J)2.,c.Qf.6.w4.i.W..n.|T..c.yJ.u.0>......R....5.L...(.....~....x.OG*K..d..=......k.P...>......B..E.R.vk...t.Q

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\safe-t.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3871
                                        Entropy (8bit):7.925259657332706
                                        Encrypted:false
                                        SSDEEP:96:rnh7N8ANZJlsMQmLrEiZyBnxhvQBC/GvoewBQ+afUF:rhRPhDA6LyDF
                                        MD5:EB70FC4885507159B615F8D8F2DF5234
                                        SHA1:63A3FED99DB4CE9AC40B2C49E1FC4A1084754686
                                        SHA-256:F614054FC285C49271D6821040EA7612C5E604B7A4AC64C158B3B08BF202BABB
                                        SHA-512:1620D2E147A7FE46ECE0A565605F2C0C10964BCE4652D4D97A1F1DF11BA69C210D72177FB9BC806C1F6AF49BB3BF2E44CD3A25AD451A41E8E6C1E7C02EFDBE59
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............sBIT....|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(......Y......1....H...:.C2...kIDATx..yTU..?...*.."..dr.A...c..C4..;.5).V....k.....}...4y.Q.D....C.h........ L..Q...+...~.\.p.>..;...u......_..g....#..H)..^m.@.......>-.-.....=...JgR..@.0.H.F..@......j.....%B.:...~.PJ...m.............q.D..f..X...R...@.0.{.J..{[..9.......Q!.eo+.H@)..`...L.....@....'..-.....M`.'.u....[.h...l %..V.D."@...@.)..^........+..$.X..In.(....Gw..c.Z)/+......,f3.5........V].C....Cll,.I.$..I.$...=m../..`X@).8...!.^.@II._..RZRJqq1g.q.m.1x.`F..MrJ.....=..hwz.[=............/*......J,f3...444..........O.$...ILH$}B:....;.......(....s.o..U+.....H5=..........<..dr,~Z..z...lG..|..r.?.x.6...oob......F.1*`...M.......*.....q.,((0.Gs..E,.....R..F..tu@[E.;.,.....n.'...%55.S......S..R..WQA.qqq..,......4..EE.Z..C""X...wN...n.X........gaA!........[..5r.g8.N.7<.t...p..... ........l..a.........5-.G/.X..y".F......%

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\safe-t_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3719
                                        Entropy (8bit):7.922465789444943
                                        Encrypted:false
                                        SSDEEP:96:mbw1zNchE96p0vyZQG8ILP/fy51iRlEKT:sw1H0pVzz67iRSKT
                                        MD5:83C26D946771AA895638259920FB2FCA
                                        SHA1:D36154772AF449A2038AE412B08B42F8E8D3A20E
                                        SHA-256:14ABF48D20B24205713A709BCC1946F2F94F3070320AD1D50848D06EB8F136B2
                                        SHA-512:AFC2196C49438A131B7D797A94462E052B9B633A654EFBB1B54ED6AE179837B4F2D2A5A198E8695222D618E18C462505A1579D99D36E034488B1E1A0D2F694F3
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............sBIT....|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(......Y......1....H...:.C2....IDATx..{tU..?;7 TX.a.`..x$....$.....)..3.X.:...Cy.3.......5.*...V..|..........`.7DI.KH&.q..o.8........]..>.q.w.}....>.~..D..:?...P..vt...W..J)w..'.7+..a@&p3....R.....+P..).>.*.RM.i.=.&.....t~n.n.F...n.....g......-....r...x.^.......S..S+...a...`..H@.......`..|...O+...).o.E.>.@L .Z.I{{;.W...v.v.A.wG..*...... ..I.H"##....U.]...Z.o&........[I....TUVQ]]EMu5..:.N6...DGG._eE....HRR.i.i...K..t....m....4.2..PDn...mq...***....NT.....S_}.O....n`...ddf.......IHL.........0.....r.....Jjkjp..Q]UMKK....A.HNI!}L:.ii...........TJ].S.-.Ed2p..}.6.y../.)._.p8x....UO=....L~R)...r...|O..bV.b..x.n...onb...g.-..y..-.6.._....M...{`II..:.5g...ry..+"c...uAgA#..\..../.nd $.Nb..8"...\.?v...K].%%$''{..*_y}....EGKK.,.bbcy.g.}..v....X.....:.%N....<...F_y.........Ett4;v.4......[.C^....6N.v8.5..#.......k....Q........

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\save.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):946
                                        Entropy (8bit):7.238902576094043
                                        Encrypted:false
                                        SSDEEP:12:6v/7StqB047Xy5ee5y5ZKSt5mpDef6WSvZtzy+/oQGfoRAs93BAGyjlv8WcY3kz6:zqBpb2X5yz5yzzF/30oRAs9R7olvxcGF
                                        MD5:524B4AE79599E80D26B065337966BEA7
                                        SHA1:3D09102D8DD55404EAFD48EBBC36AFF16E40CD6F
                                        SHA-256:91361F9D7BBA7B184E3F9500DAE1DB28771FB0A1B4EBF2B92A63268311A1D2FA
                                        SHA-512:6A9C7CF5AD5C6D5550DB2B793A32A818240FC51207F07EDF717BBC9CE775DCFDB157EDC9D662E016280C2C4F015876ED4E38D460B6B7F6DE685394BE2D1C42DB
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....bKGD..............pHYs..D$..D$.@g.T....tIME.....0-I.....?IDATx...;O.a....E...lD........VV..++:..Qk.l..ha.((..RI01...a.....X0.j@f.7.s..F.........(...............".......%]c.%IW%."b....^...nI..;.q.vD......I.......#.....W.i~S$..5..wI..X..[.{.dw.N .Z....E.O.X.F3.pv7..wm........2..R.....>.....q...{.i&..W#b.?...".z...M..R.../........{..^..[e-r...s..JY....n...8+ ..-.!.T.=..E...@...~e{....ND..q( .z...+6..Sd.|.=I..5)i..Z|(P.g...........@. ............@..k..?....k.....?P....~gP....tE.^..,i{U..C.H6.*...H.&i.....~..."..{....o%m.l.{...:....U..->...@....................>.W..%]...VN...YM..........h....s.^E5.a..0.....%.S..r.....,0....-i.M...3.j........@. ............@. ............@. ............@. ........@..X.y.).l..l/....P....bW.m.:..{..^.....s,b....lwZ<.N..=9.b.!.Z.u....{....$i.e..!i...8v.R^....&$.rtO....Z..DD/.u....R...2.2..JZVS..[.uI.#b...................C....>0.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\script.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2911
                                        Entropy (8bit):7.81621123142847
                                        Encrypted:false
                                        SSDEEP:48:Jwv4jhZueRoLGg//fTyySWNbTLumO62ZZ3mykhWPGbaDNIcBBvGFmL20Fph:Q4jhbGGgXrywbpO62eFENIcPeFC2w
                                        MD5:E4EB569930024777ADF71335659D9628
                                        SHA1:0887FFF664052DBF5C249348C3F6B1C50B975D33
                                        SHA-256:B1A056AF1AB081946509AA01247AF17188A83950B60FA7C60C6C1DAAE7F95FEC
                                        SHA-512:9B770EB23EDAB751D64B861DFE604F279BA40D79661D20A93FFD14CB0DD02BF785FE3865E2EDF89D209FDADD83A6D5C85F75B6BB5285C3A08A5F09661927643E
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....IDATx..m..E....lBr;..P.T$...E..R..%..Z%x.%...=.p.."RV....J.j...6........K.P.BI).A..Q.).Q.!;w!...Y...7.;....q.3.L2......%..a.....K..@s...c...#....4...9F..1.h..@s...c...#....4...9F..1.h..@s...c...#....4...9F..1.h..@s...c...#....4...9F..1.h..@s.........f.*.....u..j.u.0...$.%Dt..8...=.w.!..l6....p*.MQ..=..s.(...`3....... ..1.....T*}......1.%..=.a....~/-&.m.z.......A.|..?+.N..|.......$I......*............0..y./0......~n..!.V.5..........$I.-.."^.E..<..&.m.A.6.o.....|.R.l..9ELI.l...y..E.0....P.?.p..U...=.......e....yr../.v...j.3..(..AD.V.\....g|..8./.......[.B.././......em.p.$f..q...,k.*..?.$.r.....|.m.Wg]73.....l....!78..%.z.".Je.eY...Q... .>.e....m.k..R...q......\.?@D.R.....j..Y..D.(.F.o,[..e.M./=...JDw(.#......E......'2.P.3..\.?.o..h4....L..b..w.......K.$...Dq...........^.+.<.8.......Y.!.MOOo.p..o.........O1....e93.\....F........j...q.g..EG..).I.l......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\script_white.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2910
                                        Entropy (8bit):7.78162310769412
                                        Encrypted:false
                                        SSDEEP:48:Jddoic87FE78T0Vcv45kqsqYbzPSouIPH0xtychu23202ga3MXhnXGGGGGGGGGG1:TacqQ0ev45HWBxPH0xcq53/2N3WGGGGH
                                        MD5:F4C51EA252273896904B5E517D45B6F4
                                        SHA1:385D5C9AF9DDB7D41E679F9644852461B41DF088
                                        SHA-256:81D7844BB8753850E1CDF997D5DF6EB042842DC56588495CF9837F73361059DD
                                        SHA-512:5FB851442B88AD77A69E63DB4B89AE65860104022B0921D9D075C24DC74C31B0D2961750F5A569F6E49409CF8807F4D577C77CF6200D84C7BD0529F6ACF7CA4E
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....IDATx..m..E...o..BH.d7..._..(._.T...P......).0+&.AYg.....KH. ..G...1!p'~....-....._.5.B.v/(1$.;..~..*9...ef.K...<3.L2...t...V.^.......,o-6..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..3.]F.7n<iddd..K.....vyOu. X....'...u..vy... .C122...:...._JyQ;..:}}}.....y...`G.X.H.....r....7 "....S.!.M..C..R.../l....R..9.!....4..c.J.R..0L%m.h....{.h;.M...H.{.....R.?i... .<.....MsJ.::S.f....... X...b. .{....<..lN.{:.y.."r42......I.'..)e...4...We..J...t:...vi.B....6.O.;...Ap..m....y.u.....t&...........3....a..j.X...."......n.<..8=... 8..Z...9eI.\.-n...........#Jg.............h...(....B.sqz...r.....4....-.ut,G.8.SD.5.,... ...._,..R.d.[4.J.j....q..p.F>.....s..j9....g..w4.a!.R...[.1.L&.../4.9.T*.........R....z.DtS...]+....f..\..%.)..A..V}..@.......giN...8.m....;$....!.)w....[.h:.CCC=.t.?.d2....H..4..;.yw.X|{..7..).

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\seal.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):38276
                                        Entropy (8bit):7.932151176253116
                                        Encrypted:false
                                        SSDEEP:768:xAR8qtQJNd6ZMn8JykOulKvxZw3JF3bNYdGknf7XeXcwuREyd+ESU3BshYDs:xEHinjkd0ZI9RyzcyMU3qhp
                                        MD5:52B3CA06916C9DFDB5982CC92DD2575D
                                        SHA1:F69222CF35B62643991CE7E994F43AB223B7C21B
                                        SHA-256:E01E904D8F0B7CFBCF645BE75A34658A96B3097C2051122F081ABF00CBD3B48A
                                        SHA-512:D7C57F4F83E6AC0167F86E09A3F2E4FC8FA3DCD6D299508944B60D28F7F09B4A78A70CEC05C112E03EF9AF879702BE6F62711A23F0F5EBD3891438B4F2BB2998
                                        Malicious:false
                                        Preview:.PNG........IHDR..............x.....KIDATx.....U..SV...&.ww..u.........+........S...-3e.e7..X.<.......{....;<.,....,...K.K.M=0.@R....x.......^..<....<.......+...br.......xT...b.#)7...x.............../....<.Qp..q...I......x..^.g..7.....l......2o.|L.........x...B....z.s...o.?......x....?($I.............W..0.....{..p....w....k...}........](.$&.}>!.?.<...a......3}...c.+!...V.h..o..]..H..|.C...xq.......8...........x..)y<.:.'.....U./..}.......e.H_..p.I.?...x....s.*.H.\J...;#.....,.U6.........U.}*.X...eO<.........}.Y.Ll...2..?....Azj v...XD....vgg...x...cx..={~......3M..h.>.......n..w.z..rzSS..).....+.....}....h..7......~, .z.B...<n...ZoL.\.....+..n..o...K..........ju.E--_.....+L.....b...... ^. .p....<.q.'X..7..F.Q_cB...[UU3=.....{.....vu.};...}.._...bq...@OU<....q....~...G!ODzj.......H.....<.q.w..zM...i........j..;.O.fNC.F^.O3d.=.......{;.......G...p...u.?.....@.....8.._.......W*{eb..j4.....k.....FP..b.................0...0.A.M

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\seed.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):10322
                                        Entropy (8bit):7.961641798240323
                                        Encrypted:false
                                        SSDEEP:192:NXiG2KoPuBCiEtvo540UOYCgiaUMk+8qLrDXYDjyvluIn5g:NX724vUvoUOajUMprsCD5g
                                        MD5:B49187017DA350C42910561B3929BDF4
                                        SHA1:519ADF378A91AC0F05577492DD86A9E6D6863765
                                        SHA-256:E7020A4EEC65ABFF62B0884B0BEA7102CB2AE4A1FB619231A2E4E8BB910F57AE
                                        SHA-512:EFF1E0B3089EC88FA8A08087928C3315481238BA841DE69580FCD12368F60CC2FE2817C8171467367828CD02CFA8C6F7E6D6DCF7EB8635B453BFDC956724E8AA
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....bKGD..............pHYs...H...H.F.k>....vpAg.........0.1...'{IDATx..y.]U..g...;.[uk....@&HBH@..S....n....El..t...OQ......C...M#"...q@Q.. ...$...*R.x...s..c... .JU..|.'.3..{...Z{m.mN'$I:...@}.'..UU.....O..(......Nw..B....".....K}..9.7...:.......,.D....a.l.P.B".z..".q.../....)..#.w|*.s P.{.w~..E.d...t...}.r.....u....Pn.B./C..o\xy...x....{....Sm..q.J.....A'.&W.N......e.B.z&...1.4.......v.)..1.$).e^0.*`!.@z..=....?v....We./.....N.;|...t..?.|..%.y....h.D,..H.L..L..........x..........f.9....P....K..~..I6U.....h.2.E.ab.L.9..1..s|~....e.B........k.o.=qd....... C...R=...@.C....p.....6.:0k..E.t. .-...3.D.%B....B..Y.h.6.}I.3..%.{.M......s6.8.U..(..-~...+.o....t..fzO.e..?.....dR.2)...bm..px.8..........C....vkD..4..Q..*.)rx...x..W?6.v2."F..s@......^.../+.r..^w..........+'N..9z .........&.<..o..>|k...zs7.....g....x....<.dC.X......V..H.{Kc.....z.x....{.{o....q ..H.......R..M..\....E[...r.....9s...,G....l<{x....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\share.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3325
                                        Entropy (8bit):7.887613741553613
                                        Encrypted:false
                                        SSDEEP:96:oSu44NQ3mHvwJg/FhWLmNJdzL+2ZZqoCHOBY:oSuThHR/FUmNfPxZZpyb
                                        MD5:B285C32910F8F429E718E8781862478A
                                        SHA1:182CCD2CDBED505316EEB79B33D05B79AA032F1A
                                        SHA-256:A8BC2EFF5BFD5A8863738A09727D8D62AFEF8C354BFA51E1D669CBE70F21A182
                                        SHA-512:DBA28ACD787945E94DAE86A5ADE215993BF531D47CCB200C42F12FBE44CABAA1B7152B38F1B0415952D661BA3801680B551BFA5C1E9758948778565E1FFFE38A
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....bKGD..............pHYs.................tIME.....).P..m....IDATx..{X.U..g.n..~...."xI@......j...Y.<.c..].r.is...6}..L3/)x.T$.L@.......3\.f`ng.(wm..3...._..........;.<..D0,...g.y.4X...&.a.X8L.&....`.0...&....`.0...&....S.{l.....@G.' ...<.|`gm.....J.......l.A...D.V.<6.~............iQ..h.<....m....x.~2..1.L.+......OMx.WW.P..u .x#....&.....-~e.....1..[\..[O|D.9..l..!..a....9O>.L.....>...n.L.#..-....pw...1.|..:mC.......p.s........9..>.>......Af...._o...Cj....0......z?..E.w..L.....I..rlk+.,L|.U.C2!<.z..3......@.P..0..F.6....05.w....W...#..5x....A.a......O.../|].).@...4.X.}.Y..7...F.K.G..@......#L.}cg#0.X...2..0.X......H...F..D....9.CL...L...+....W.....;\.U......@.T.....q.S.20......PS....r....Su..j.....-.......I.O..Gc[.a.h...%H.&.T..@M..Y....-7..H...\..p.f?....&.FW|..8.Uk..u6b{.FNV..-+..&{........+.......@G.M..."I.;Wm......tN.bL..0H.W....W.Z......_...v....%H..l...:.W....e....rz....vq.*d.wv+.U. *.......|..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\speaker.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 16 x 14, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):392
                                        Entropy (8bit):7.094128145339606
                                        Encrypted:false
                                        SSDEEP:12:6v/755vlvZUUBtLVLtpAHYqfr1YRozObbf/6gU:65vBCU5pDR0ebf/g
                                        MD5:5E2F1E05870F10236CA49F7779146651
                                        SHA1:53368F74DDE769486680C05737D699F4279716D1
                                        SHA-256:E5E86CB035D56CCEBB94B895EC863C5B6C89001973962EF3A2D3FC9B14D740F0
                                        SHA-512:004047CBC4DEE63974060AC8EC1F9C18D0F6187C2F2F6D17EC765F84F3CCF56CE6C1BB8C4927247A9725D11CCD3FD8D967FDFBEAD84AAE72EF2960D5206290F9
                                        Malicious:false
                                        Preview:.PNG........IHDR.............&/......sBIT....|.d.....pHYs...%...%...z.....tEXtSoftware.www.inkscape.org..<.....IDAT(....+.Q.....R..4...VIY.&+..........feca..-...)%%.U~...+.k.)3.2..Y.s...=OD...B...J....-*....p......<O;.\[}..Xji.!.`..Y;..F0..n.w.,RJ.)..+.#b%"..b..).FJ.7".8.F.:&........!g....T.|..,ED.a..Y..tQn.._.&2K.R...v.4...G..&.J........f.k..k.&Hu.h.R.Q^...G.E.....?..E..d....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\spinner.gif

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GIF image data, version 89a, 128 x 128
                                        Category:dropped
                                        Size (bytes):15209
                                        Entropy (8bit):7.832309628792709
                                        Encrypted:false
                                        SSDEEP:384:loXLumk5i9IIS1fi1ekpslFzcdEeE2dOo+gFRiAVJlR7klRHRsW9:ixH2f1dkSFzcqbMOozFzMxs0
                                        MD5:6E58AD65334FEEB5E49BAC33334AB526
                                        SHA1:AFE8B6F09FA004BDC88A0D649D857D8E6A6D76F2
                                        SHA-256:CC4FB2AEBE634B741BF2616B811DD630E466A9A8930B9BBE10A281F9717DAC58
                                        SHA-512:EE8EC86152675AB2D126BDA46ED63674BDDD31835F084333696361BAA2E7B7C281FB2E7966A75711A72908F87F96F9230A334630AF31F485EC4B935EB95070F6
                                        Malicious:false
                                        Preview:GIF89a.......$&$......dbd...LJL...|~|464.........trt...,.,......TVT...ljl....<><.........,*,......dfd...TRT......<:<.........|z|...424......\Z\............................................................!..NETSCAPE2.0.....!.....-.,.............pH,...r.l:..T..\F....D....4-...g$ )Xo..sd.4.|^.:.2h..f...qp.o,tFvyxxzw......D.#n....D.w...y.'#..g%.....p.C....z.....M%*...B,....!...E.....u...w........su.z......*r.......$i..`^ ...).u..3w.E...`....jd..G...M.f.|.A%k.,..~.<" Q.I..(s.Z.+..3.>K5.T.H.Y)u......NW.(Z.'.I..i...LH.D`.:.....}...l?.d.....G...z\i.,.<...{.A.!s.\I....k....x.].5..IAI......M.E...(.[..:.M.L.:.k.D...K....3..U....i.=..w.....C.H..g.$ @.....N..<.....xG...u#..bH.\.....>/G....W.g..C.....A."@.......0...^U.^.. ..l .~.<8D...@.te..PqG.....NS...(...........o..."5.....-..."SI...I.X._.$h...M......a.#.%%....A.....I(!(c*.@e.NVD...)..].R..**...B.I......s.. .Q...(..DF.=.i...:L4.)..nJf.......&q..p(..Sj..Bql.D..".$..]..F.9....k.=......bp..O6;.q.*`..df...."

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\status_connected.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):71068
                                        Entropy (8bit):7.98934726992817
                                        Encrypted:false
                                        SSDEEP:1536:IE3lTv6JiUQhPsNVAAgkcjoDRjbnT5Zk6zWfJzV2YrDQiPnHL:J3lz6MPUlgkjjbnNVz0Z22DlPHL
                                        MD5:D0F584A62776ABB93DF85D8DA2D81843
                                        SHA1:94A10ECE353ADBC2B530A4758FDED9CE885CE0D7
                                        SHA-256:7AC930B1113B8A35B428909E2D6BB737C9DEE0CACAD5B1AACF4B36D48D1006C4
                                        SHA-512:C2002DB69265DE5E4E9890EAA8978BDBD59763A8E9837A38FC4893066B3CFD95CF65C9BC39B105C19CA0DDF8D85F9F4EE9B9A8F59B05A06ADBC580B8B3BD5698
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...w.,.y..."2....y...a...&AR4.4.h.......fd.v.h.YiGgf.f....G..%....I;..).h.$..h.6H....}.....GUVeF..,s...2#.."2+~...`F3....p..*.....;N.u.B.w.....>A..bF3.......{"...8...?'...0.........&-.ft..L.3.......V.....E`...w..3...f.<..%).Z.@)..7i.N.uc.N...0.hF}.....g".l.@.C....FC.C@..h..;....4.hft?....$..~.....`...wF3..i6...^%.......2...3.N....V..m....4....KT.}f..C.C@.>3.....5..L.z`[.P.L._..h.>.........gt........hF>.F.33W......g4..`..V0.rg...=.u.=@.&-.f$....h..b...&-.N4....c..xFSF3.....tg4j....f.<.IR.t....3....xF...7.q..P..*...3.,1.......p.hl4..f4.......,.jF.I!z |.Y6....f.<.QRdb.CO..i~...y,W...U.e.........X........u)a./..:8.b.D.F........0`........!#.....a.{...c........M..m.....5....6...)...#..xv>.FB3...(....[.}....?.3.%.l......:.;K.z.Pv.P,....5X.=...,..b>y...M.E.:...u.e\o....> ..B....\3*.f.<.........M.Q^.{..\....*....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\status_connected.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):6593
                                        Entropy (8bit):5.024932699526309
                                        Encrypted:false
                                        SSDEEP:96:VkoIanLDh/IOKDYmT/35VYfLD++haM0c8XBrTo8eaABra2BS865MBR:VkaInDroBgBrToJaABm2BS75MBR
                                        MD5:1206186CDCF64DAAF9B40B26E438C5BC
                                        SHA1:A1D4104DCA55EC6E496ADF582E9F56C4A936DE43
                                        SHA-256:63CA3C36FF8AEF25630C57A2214BA8BFBD279C9631D050F296DC437D75BB2A5D
                                        SHA-512:D31BF55DD7A454A864DA65BE01AF3B9F3CB37316D8D7D687BC6DC6B6EA5BF4723ABBFD31D7C9C7C0F29C0FA2157446D16EBC061CE7AB8DEB436CEE4FB42C6512
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". version="1.0". id="svg7854". height="512". width="512". viewBox="9 9 30 30">. <defs. id="defs7856">. <linearGradient. id="linearGradient860">. <stop. id="stop856". offset="0". style="stop-color:#90bb65;stop-opacity:1" />. <stop. id="stop858". offset="1". style="stop-color:#6ac017;stop-opacity:1" />. </linearGradient>. <linearGradient. id="linearGradient7577">. <stop. id="stop7579". offset="0". style="stop-color:#000000;stop-opacity:0.3137255;" />. <stop. id="stop7581". offset="1". style="stop-color:#fffff

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\status_connected_fork.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):62949
                                        Entropy (8bit):7.982829157758787
                                        Encrypted:false
                                        SSDEEP:1536:SdnxbIe6YkLsoOgdWTs+yDbw8996DqxcRS47UDuCgrTzs:An76YnsWTs1XLn3yR3VTzs
                                        MD5:65997F133AFE7CB19DD8F0C795180071
                                        SHA1:9417A78385E193227C1A79ABE9439A2FC0DBB2E6
                                        SHA-256:69FDFE1E93313B6D23FC76DC1F71D0F100FB47DBBF80096A289E4B83BFC90CAF
                                        SHA-512:441EA59297B6A3B7F31817E4EC771AFC0DCA318FE17E720DCA4B6A43DD3C482C61F5D1A8F75325517BB98F58B3D81452A39C38B9D1112ECF6B10BE1716DD44B0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......bKGD..............pHYs.........B(.x....tIME............. .IDATx..y.$W}...7..3./...I....H...Yl...2......n.m.}<}...6.=m..3..=....M!@.HB ....J..}.=c..G.{./+........y.."#c...........W.D.....XHi..w..~_).....R..j.]Z.~..../.O.../..@,-B..._.7V...*...o./=...0.W'.......5zN.`lV...........h%.r.%~j..Y..e..`.......)AV.....?...+...@/..P..............@o..-..J?..8......VJ.Z.I.i..9% .J?u.8...z[j......+..........E.%.j....^S@.-.?%\..\\.\.m..o...@...p5..0....w....r5..b.:_...O...0..{.2.....%.g9..8...8t.8...8..z......8..8....{..K...A....`.--<.....k.I.....O...M9%....qqq.s...B.........F\. &.B\TX.JH..b."....A...BEJ.V_x.t{2...0.l....`..\......+.Fr`...`....&cX.Ml:66.<Y7..F>...yl.W..[.&.L..|~d..`...\r..k..*..C.1..I%.&..IA`.D.S..1B.C.$..M...8..E.Z..X.r1.f_\9..z...k@.."..........n7TZve..%.q.f.....a..l..t.P6I(FP..|-.a.K.&....,r....|....s8..vme*..3..sq.s.....U}.......>%B.J...................5=C^.-.]x...{....}.I....pq.s..d.....kM..Lt..$j8Jev...:

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\status_connected_proxy.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):69081
                                        Entropy (8bit):7.98078809957044
                                        Encrypted:false
                                        SSDEEP:1536:1W2XgN/85rV6TtUUH2yef8XqdrhXuIs5X9Dq0WL2:fH5rV6Ty5ykEqdNXs5X9u0j
                                        MD5:E5CD2C7BA9B105C2E13AE179830F0DBA
                                        SHA1:BAB3BCC2963FF0A87B300A02F9FA686CB30E1000
                                        SHA-256:D014EC74FE25B357D3DEE494501B4E867CECBC3DCBA7DAF7C9995C388E5C8C20
                                        SHA-512:0289D82185D1CE85ADBC84C1046F54A70912E42568DF3CDBD3B649E19FE3B0F62C685C25F3426CC36356C93E52D9D16ACD0DA05A318B31F10CDAC60E76BF0961
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...w.,.y..."m..7.l...@7|.."...4"..pgt$.......@.iGgf.f....GZ.2.8.H.!...BD.$....a.h.}m....{.df..UY...6#......~.2#.."2+~.......e.....;.8...|...^g%.|....7...>..2...]......u/.}P...7.o.sX~o.#0N?Q...o:mC.2..,..C..\.-...>...z.6nJ..q......2....x.s.K..>. .?m....2.n..90.e.....\^.B....@.......... w.t...Ay..K.w4sy=....<......F`...;....2.|.r..A.`C.A7D1.x..).........%..6.9...v.Z.3g...P..9..e..^...\....m.@.s..z... .m.\.RF..<..&..`...=..D......z..F..<.Y..#.[...E........9..As..H..<.Y..#...1s9..F...0.....x.."s..e..s.)...\.)Y.c.>.er2..L]...\&-.@s.a...e.B....g..5...........y .\fS..Ax....2....\.)....>.}}...kgW../#l...V...p.e.o.....,.$...8.\x..... d. ... ....}.....l....w..4.......l.&.H.[..M.....-tv7.....K..y.3.....E....#.e,2..C...n......z8..i...A.p.nx..w..;.BN.dy.......t.....w.It.q.%t..b..U...W.....j...2;...5..e..s.J...n.......o........

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\status_connected_proxy.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):6593
                                        Entropy (8bit):5.024087779747235
                                        Encrypted:false
                                        SSDEEP:96:VkoIanLDhAYOKDYmT/35VYfLD++haM0c8XBrTo8ealWBra2BS865MBR:VkDYnDroBgBrToJaYBm2BS75MBR
                                        MD5:A73D4FA5DF06DB0120444E5C11D8B978
                                        SHA1:B988B93A6EA1466C9F23158508C2130D2AC722EA
                                        SHA-256:1F8CB23FD34E40295B39FFE747177C4EE0AC64167DF47FF54754E12916464D3F
                                        SHA-512:2D26A2A8FA1E451E5C1D0FB2FC5A3DE471C8F40C4A9E03267A286730F2E8BA73019B3A2923D0F070EB5C3B4EB09AC4D880E2E83B53D9800E5F0DC12910CC1B5C
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". version="1.0". id="svg7854". height="512". width="512". viewBox="9 9 30 30">. <defs. id="defs7856">. <linearGradient. id="linearGradient860">. <stop. id="stop856". offset="0". style="stop-color:#479fc6;stop-opacity:1" />. <stop. id="stop858". offset="1". style="stop-color:#0c89c1;stop-opacity:1" />. </linearGradient>. <linearGradient. id="linearGradient7577">. <stop. id="stop7579". offset="0". style="stop-color:#000000;stop-opacity:0.3137255;" />. <stop. id="stop7581". offset="1". style="stop-color:#fffff

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\status_connected_proxy_fork.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):60879
                                        Entropy (8bit):7.981421748345525
                                        Encrypted:false
                                        SSDEEP:1536:CsVtpUnjIdD7GyXpOsbhtd0VS8ejXGHvAMCIQT:CjnkpBHbCrv5Y
                                        MD5:A696EA431A0D5917561454FB73FADAA5
                                        SHA1:27A965A78623BA38216BD66365A456FA4DFD848A
                                        SHA-256:3587790E9736AAC4DA7301CB971E5BFC256FF55681A2F3F4BAFBBB870FD582E0
                                        SHA-512:2CFCD80BB7FC29EFF01FA8080B708CD61FE76DA26DA38621E0861220F2679BD664AF57AA30571E220CEFE7E364449D27A88E78CDB38C3CA44C90D27422A232C8
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......bKGD..............pHYs.........B(.x....tIME.......>..s.. .IDATx..yt\.}......W../.@.$...$k.,K.#Y^.X..gqg...xz:.....v:=.d..'..Y...t2.]..e[.-.%K.).;.bG.......B.....{......@...[..}..w......]....B.,..T._...e..?+-...Z..b.K....?.\\.<G......_+.^y.X...Y..=.........T.k.Wq...2..._9...8...Z...@..^.)...^.=.3...0..H..2.......G...:....C.....k.K..VA.?....0...rqq.sq............K@...j.%sq.squ.....#V..........A.%.......U@.W,&?%\..\\.K..6X......+-<\.......-;\..\...Q.Q.K@..).....r.Z.r..tp.P...,.1..0......1...0W.@7..G..c..`....PiQ.=..a......'pqq.s.8I..."..T\.)...4x5...`..W9.........D.J<.%..$'@.>.B.DL......D. ..r_x...'. $....$.R.=c9.b...S...(.X.f.......u0{.....Z.e..,.B.A[_...5..4~....)........3.KN7.k...1q.....#...q..8.8.BF....f........<l..l..,.2...d....+s..]r/..L......0W...pi..2....;.!.?.Y...'@.q.:.B.P....d...`.e.....e..yd._..'_...S+S.%W.......$.......<....P..A...J.!.G..C.......2_....B.E....O\..Ipb(...P.Usqq.s.U2.h....f.8...).c... .!..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\status_disconnected.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):66105
                                        Entropy (8bit):7.977649505362057
                                        Encrypted:false
                                        SSDEEP:1536:GuqnPSCFITkIZ+0PTn5mNUSM9iGucMMVhE3SqiPgkNStsZQ21m9S320:EIguj0NUhUwfBPgp9Gm9o
                                        MD5:7F91E463D8115D560C4FB7CBC4227058
                                        SHA1:C0FDEAF061A4BBDCD5FA0AEACAF7A9DFB4A0EEA0
                                        SHA-256:A0944E10E92347ACEE4F95F57917877123DD18D7E64C0CF13A82EE2C3FE82818
                                        SHA-512:49518E5FC4AFFD07F43D9C2E5750E7DAC59DBE55D1BF6D129325CBE03807F1575B7F876CE4152FA8629A2AED476AA46AD1C1A2F55F375EDAF64F723BAF0A6E1C
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...w.,Y}...vUu..=7.;.N`.<..03.......$Y...0X..dK~.F~....sX.O....$. $.....a..f.`....|:T......z.].........S..w....o../...4.n...m...4...G)<....7m...g.../...4......{"h...........Q\...W......Z...h;.vy!.h@.&. ......z-\.(......8.h@.......N!.f.d#...Z.mF........4.&..x@.3.4@6. ...;x..!...\.Pi.;...].4x...z".@..;x.zO5\......5O....U"h.l....3.x@.I..........<.k...<.k...@..v..* ....h....5..L..`[.P.@.^......h@.2....h.Q...-6.?....l4..s......x@.N..j.y.....)@.D... ...h@.........[.0.......c....3........;..i....+....zIQ.-`p?..{4....../..u...R.....Po....... .k@]...o@...2.!..........d..P.h...J.B.s..m....@.V`l/0:.....<0..F3.......8@.4..%....#Mv.....)......f9..Xk......|`...k.b.X........x.X.6... ...X.54.xP.y@.......e..tK.N..=@..`.>`.0.....6~{.`......\.....p......6.s...3......5..: ....*..&.J...<...AC.-..M.1.x.....n,.............\'........g...>.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\status_disconnected.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):10522
                                        Entropy (8bit):4.949142549545152
                                        Encrypted:false
                                        SSDEEP:192:PkFc0EcY7qRHh6CTChLEEp386Vf1ZvncfIr/9IfOh0Zz2fP:8FemhgVNZvcCicS2X
                                        MD5:6D729F445BB3C138010229DCF6D312C4
                                        SHA1:2E05438CD92FF5F4274964E432A1B28FFD8E90C8
                                        SHA-256:96F4BAE021C1D62AB75259FA48470466F4C26B7AFF7D233A1FC4F686151A69F2
                                        SHA-512:19AA7879FCED3D78ADCDCEEBADC8A312C59DC1D151B5D40A01C7F556B2C5717DA271A23D216693B38F49FF09520897F77402E13839AE481F6A565CB9E17C64B9
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://web.resource.org/cc/". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". width="512". height="512". viewBox="9 9 30 30". id="svg7854". sodipodi:version="0.32". inkscape:version="0.45". version="1.0". sodipodi:docbase="/home/dobey/Projects/gnome-icon-theme/scalable/actions". sodipodi:docname="media-record.svg". inkscape:output_extension="org.inkscape.output.svg.inkscape". inkscape:export-filename="/home/lapo/Desktop/media-icons.png". inkscape:export-xdpi="90". inkscape:export-ydpi="90">. <defs. id="defs7856">.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\status_lagging.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):74851
                                        Entropy (8bit):7.9882419797490725
                                        Encrypted:false
                                        SSDEEP:1536:jAwnI3nvBFoq1swn1Yp+FmO2pkTI5pFBKLdbelau5mCVe+3yG0:jAt3nvBFSw1YWmvyTsKLdbcaMe+R0
                                        MD5:52621ADCC73C96EDF0F839BB9F0E0442
                                        SHA1:1EFADBF184F9193818BB122DBD19FC39BF2FF68E
                                        SHA-256:4D83FF89352A47CECB29B32658BA34B3C2B37508DE3F3D219FE183FD3C349378
                                        SHA-512:BBEF94F6A79D4BB88BF49B579DF37D6B47F0024A49457B67030CA8258A2114EA947E68953A93CE37CB00BC8766502EAA629E0DCDD8BD11146B448ECE94969475
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...y.l.U.....9......\R.JU.....B ..K..<...6....._.e.........m..ll&...6 !....$.$..@CI5Ow....G..aG.8C......e...cG.8.c.....hE."..?.x......"%.U...|.Q.S.h......h...X.nzb..j0..._.s\.7.).'...7...-.Vt....+Z....1.V.o.h..D.....+p^.Rh..+Z.L...*..p..3.....}..+Z.V......F [.P..pW..l.c..}.....(...@......5..z..O.L..;.......|Vt....`...n..7..b...;...JK^..H+.^.D5..no...r.Y..=.....g.1..:..V...B.@G...-.V..V....F....1..........zE.V...e'.S......";....;..r.h.V."...xE.H..Znc...XS.# >...W.d....-..@wE.....h.h..+Z$..[.?.h~....-.V...M.@s..a..W.X.......r.Z..h5..h^..h.X..jE.I1F |.U4...V...YRbbna....t.$./...Ml6+.jT.U..].............0..c..p6j...<.u...`...h.Q8G..{...|dbE....C..1v...Z/..`..G}\;...............VK@.......|...V...YP.#M...D..YG..;q....l.q...B..B......l....2.v..../."<;..lw.g.;x..=<.......#....c4.9.*..J.....,.0.t[.A.d.#...p..-..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\status_lagging.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):6595
                                        Entropy (8bit):5.0234758245261375
                                        Encrypted:false
                                        SSDEEP:96:VkoIanLDhwOKDYmT/35VYfLD++haM0c8XBrTo8eaLBra2BS865MBR:VkTnDroBgBrToJaLBm2BS75MBR
                                        MD5:9265B57B15B5E5C2AFB1E4F92D9DC500
                                        SHA1:881946F9FCF507F00A022FF588D41A775DAADE07
                                        SHA-256:0BF5440323D2A3F305893765345EDBB083B9227BA71C62F653C991B273EE3718
                                        SHA-512:446C2151238D088C45B0160C4AB70917CACBAE5280128981C6CEB812D91EA20153D888706AF2E1334B06DD6FE0B36D6225A199C4B59A105344EE5D409EE50C83
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". version="1.0". id="svg7854". height="512". width="512". viewBox="9 9 30 30">. <defs. id="defs7856">. <linearGradient. id="linearGradient860">. <stop. id="stop856". offset="0". style="stop-color:#ef9d29;stop-opacity:1" />. <stop. id="stop858". offset="1". style="stop-color:#c67f0e;stop-opacity:1" />. </linearGradient>. <linearGradient. id="linearGradient7577">. <stop. id="stop7579". offset="0". style="stop-color:#000000;stop-opacity:0.3137255;" />. <stop. id="stop7581". offset="1". style="stop-color:#fffff

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\status_lagging_fork.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):63949
                                        Entropy (8bit):7.983366386938507
                                        Encrypted:false
                                        SSDEEP:1536:ehB2gJmDdzuAgauCElwpEYrLiRVmQ2Uc37kr7iB7B:eKgUDdHelw7WJeQruBd
                                        MD5:AD62F5E3C6CA426533A9716B0D38C5CE
                                        SHA1:17E9A7D5CBB7E4B296821DA61B8A5C121B3AEC5E
                                        SHA-256:9B9999EE3BB160B7E98C3753D4902D4BDC43AB0519700D9D12F50FFA2D717249
                                        SHA-512:38F35A534152AC081D263D27C93FB629FD04718040BC2B4EE5868252257A4833A04A912F3C7028355E40A2DA354FD50EA3979ABC9EFDA3F7D31EB10C0C6BFDA5
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......bKGD..............pHYs.........B(.x....tIME......(...... .IDATx..y.$Wy....{.UY{wW..Z.... . ..-...m.B.\....;..c.....=.y.kc0 K.....F.@.HBF..P...V.....GdVge...[.y....+###c9.x....pqq.J..PZh......+U.{....g....Z.]Z.~..../...../...@,-B...eX.7V...bU.,............"..Z.S...c..O.g...`...@+..+~...iKf.bT..........R...@..../.#V.d..^........%.P.....p.e..K?..8......VJ.Z.I.a..9% .K?u.8....[j........ry........l5...p7..........0.W.%.`.(...e................].W.9pC...m~H.8...Z..p..~8.<.X.q.......C.......k`............\.......X.......8..6.$.!.a.D*...S.p......0...b......(..O.......e..E@L....q.".......}..=...P.H.H.u0.[...C..q&sC.p...".a9X..eI..b.X..X..X>.....|j.:.ta..`..G.......%...,n7..x.NLOG1..0.J..D.H.[....@.$..!o.+..i.......7...x#..O..S.i...@..L......0....Pi..2...o...q..*..."...(f..q.c.7....Y.........9...^...z...7le*....sq.s.....P}...#z..v.G._..[..[.p!..f.l...6..-.N....K8./....Ipbp..S....pq.s..d.....j.q............

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\status_waiting.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):81206
                                        Entropy (8bit):7.983144606747959
                                        Encrypted:false
                                        SSDEEP:1536:uJOWFmkX0woejGhjQw/XVzAVwROKD/mkOrlyIDhqkf9mEenq81CgKt4de:uJXXX0woejGMw/FUVyJ/vuJDZ9Ckg24Y
                                        MD5:A3E497D845F86FE75D0B134285009EA0
                                        SHA1:8291F177F130EA0EC8B6774E2C463B9E93C6FAF8
                                        SHA-256:4AD2A90614526CDBDECA976DA1F43BCFC1DB2E00118711C5A3D39733FB7D83BE
                                        SHA-512:1BCDA9560E23AF1C4CEF82AC3892EB4473D2C23009CAEEB4D77E664E5B6C00AFF0B9B9A3B1C7084399BD9648493307BD5905F99BCFBA2230CD451C6C60A2AFBF
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx..y..Wy&......{..[j..n.c0{0`.%...5.$...L&...b93....Lf&.M....IB....2.L..0.6.m..^.ZU....}..n.m..u...}..R..V.S..((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((($.k.-.....X.ut.X..((((((..;....L...n..{.......n........!...LUf...U....{..<......$.e......K...h3hQ..M...K.17zbr....c..uPP8.1......0.!....z:..{...y.g..H[.. ...r;.mc.$1.........c...e0....0.......8.N.p..'!.v.z..m....kVP8.s..w../.8/.....g..{]YP..0......s[..m......E...a.....Y.5.)..Ax.....`.B.If~.t.}...}|....0....2.o../..[...9...k."`...kg.....k.&.gC.Y`\.`.. ..0...0..f.....z..k.<t...Z..)(.'....&.}..gHQ.#?..o-......Xa.0}.L.......\........^.3.....G......?`........{i..k...o.O.....J...~..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\status_waiting.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):17633
                                        Entropy (8bit):5.101367370782234
                                        Encrypted:false
                                        SSDEEP:384:8wj75ePG9o0fnXvCsenMPWQt0EcFeHLxlWQVcnmN:8AYeXaPM+Qj/WQVcG
                                        MD5:B25E3F0A10C42926E4F17DFF4616CA23
                                        SHA1:077F51CFB455EED7EA10B1B15FDFA63FDC798C37
                                        SHA-256:07D8E8DDA01ECD8E17FE439727287FA4794384E01E9BA2D17D14822CDFF04E07
                                        SHA-512:34CC1A9DD6043D522740BD17D30F81F4D0197AAD51789DECEE98330F24E7B60DA072B00E24DF2E726E488105BE1DE6A306C6E0151AD3937A797ADA0806233379
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://web.resource.org/cc/". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". inkscape:export-ydpi="90.000000". inkscape:export-xdpi="90.000000". inkscape:export-filename="c:\Tango\git\view-refresh.png". width="512". height="512". viewBox="0 0 48 48". id="svg11300". sodipodi:version="0.32". inkscape:version="0.45". sodipodi:docbase="/home/dobey/Projects/gnome-icon-theme/scalable/actions". sodipodi:docname="view-refresh.svg". version="1.0". inkscape:r_cx="true". inkscape:r_cy="true". inkscape:output_extension="org.i

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\tab_addresses.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):886
                                        Entropy (8bit):7.6289522162101475
                                        Encrypted:false
                                        SSDEEP:24:YMd6kufXgEfW4mgdLg0dEWMIyclXDkS1SpiDLgcv3wxVH:Bd6k0PfhbdLgsrF1dDL13wxVH
                                        MD5:AC4B8FA4390A63008DAA29AAA572F92B
                                        SHA1:95C8CBED0038D022E72D76BDDFAB933477C86997
                                        SHA-256:92A0F0FAA9108B03A7F85DC4BB494540C7A121EBF3153973CE0A0B1ADEA5B4F4
                                        SHA-512:62580A08F5D9820EDAD835774BB9C844DEC6DE626C9201A2F363924E7BEE3F0C31B76AF787FED645CF9AE8D3C9B55D233CBEB8A1B93C78A9CFA4C6D15852C683
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq....=IDATx^.ZMh.A.~..D{0..F........^.Z...........U...m..&......*..j.&.A....L[5....$#3..l.U.5;s..^......{;........@3...h....:.j../.J.A......[v>..]?I.b..!Yk"......O..!g/....wC....J.!.^.ZT....b...g.D|...Gv..J..Rr.i....\V..r....t.j........P..N...iSe.js..\....%..p.U.>..Q..4v..eV...u.?.:..hW...6..........Ms..s...`n......;.y.....7O.......4.\..aj$.4.m#.z.f.9......v5.7`&....@$d.w.&..`..c...F...[...._.0..........flb#....@...(..t.tb.d.X....x.JlL./.,....*.B..voW.y..F...%....~...lg./..'A.... #.....YB3..j..a..k5X.....>o.7h..c.Kh;7p........!.Q....VX'.j..Z..e..m.....R../=.........P..d.......FH..P....".DP+.dd.....A...Q...[.N.NL..s..o,.n.<..]AF...NPPl.i4..n..wG'A'&A.x..i.h..N~...i....*....5..W..S.\...y.....k.j....cJa._%<.y...g..=.r.............]......u9.<I...h..yD..+..gk............6.....4.0(........d..I^......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\tab_coins.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1592
                                        Entropy (8bit):7.788494723888087
                                        Encrypted:false
                                        SSDEEP:24:L0oFc4ZD0wVdHvXH93UmPY3mDVkVJ7hs91JFnueYMv/wEfxW:lFNZFXd3/g3nV49b9ueVtW
                                        MD5:1EE6C2BF2A3AA970E939A290903F3AB0
                                        SHA1:8B0B56829FF0D439B644ABAC1BDC2D2E1F8C3A8A
                                        SHA-256:9AFF6228C45DD2447A0D9E3DAB06D6C10818265B41D61B6BCDC8B8DE193CA6F5
                                        SHA-512:9A43B724C16AF2686545187BC565A3544A1A311F5D76DDEC8CBDEFD5A24DC624F648A09749CB12DB89B0C7E21B67ADDB2A1B474DE4C96C37F0A99A27A1B6258A
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....IDATx^._L[U.....[h.m.?B#,!.-.......^\|1{2q.1...'...........,.(1dq....2.EXA..u.....B.....9.B.....[...m......s...sz..x!{\?d......$s.......U.c...J7.......A...#..[..q.........+.....BbE..Bi.....=Gj.z..I+..p.j.!'.vPP=.7....s\........6.........T....p...PY/..{**....K......0.6.....u*.%......%.y;X,..@;.r..S.g......CL.@`".X.;..^.n........q.....|.`.T..W.%8..=@`............c...N}..F.j.?.a...%....k.'.....+!...&.(p..k..........f......V.Y.#.IM....,...c.ol......w&X...r.S.<"..W^}....8.2.K<@...U..A.%2..*..?....e...#8.<..ysZB..2.|N%`>(..&.....j....X......O......'...0D.1....>@.....}...d. 1#..x.e..u-.1"....$......o.8..K(PL....I.9.Z-...(fM......z......~.Ky?.94lG8.....H.%...z.......=.....<6C.........}...o.B.e...:.#.V..../...I.~....9..."H.5.O?.~{...<.m..A0.b..\...k...C..@..1t.z#.[.....J.....m..i..d.....U8..{.}....r&._X.T7.....X.T........F..\.......O{...@xy.G.NX....8C.@Y.u~.R}....m...l4.l2B.Q..O..B!,..0;.[{-.xn.6.}..>.."k....>..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\tab_console.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):824
                                        Entropy (8bit):7.612514809801685
                                        Encrypted:false
                                        SSDEEP:24:+ZK4Y2G9OPn9LW2qdM46VLQXlt3ePqvHnvM/Yp:+Y4hH53vqJ
                                        MD5:BC516311DED0419013352FB03492ACD3
                                        SHA1:EB601A41D822FEC612218FF85D03F2E1564AE2FC
                                        SHA-256:DB79DC87A2240DA85B585291B442571E98F18765CB493567209E075D6BC87432
                                        SHA-512:C8608D97CF82B1E7356E942C33EA5607ABE9E4A91C469CF32879B4FC862BCD18F4EC9F4FC708668598B1EC603AA4D722ADE6D365D90F414C6529793FF175E60D
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....IDATx^.?l.q..P...hb........J..M...uQ...&N...51N&.h..6e.....&.M...`..Xl+q(...Z..(.5w..Z8...{.......{...w&.|......"...(....T.+.@(.....a.F...w...e.D"..)...0..@...x..+n.....G>l.N.d..D.v....V.)...............$~n1....].........d.m....m...f.V.....Eq..._.).<..1...i..F..|.VxZv!.>.5A.......moL..*).....a...%....'...w.,.....)e..aV..^Os.1..n~...=...9t..q....b... .........pp`..P.P.P.."H....A.....F.:A%.p....L..2...'BA...a.u...* T.PPmy.B.a....B].3.....F.`.?....jMCU.9......q.\..d..H...Z....rn7.+....,....?..ri..$P....Md...z..`..|.8..n. .5x..7_..j.d.z!^...Vwi!...:>Q.B.*....}5..v.PJ.\gG..`..+.....x\..U3$E....b.<@I.Q...4...p.........J..9..:...%..P....@.h0B.!...l...4..7X...d......%..,.b5h\..z<p.\lk.{7.c.Y..........-.......!...."E....{o)..3...<.<_...1....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\tab_contacts.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1446
                                        Entropy (8bit):7.8007038316507105
                                        Encrypted:false
                                        SSDEEP:24:OL4aM6GupQZ2f8gnuW7jln85omyLYbyR+6YsHovESL8ee81qKG7TMZXD8bWL8Y6Y:OCDZ2U4lZmyEztZL9e+qD7gZXD8iL8YL
                                        MD5:0788B8FF813FDB1A30027FE5365DD696
                                        SHA1:990EA3F4929CA78826C8A705A812ED9CF42EBA5B
                                        SHA-256:577F8E407B16E76EA191101943A67235F3BBE18715A952A425BEF123DD0ACDEA
                                        SHA-512:47C9CCB8A2C77F8D15059760081169583F47EA93A014B775734FC50AD4A5A7C843946BE022F1DBFE99BEAAEC40833CFA5BA28E24BEEC77A63A02124A0331DCFF
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq....mIDATx^._lSU.....q...F...D.......B...X.O..bd..M.....x....d....Hf.<h.h..a.NL..H.)&.!..j..6.........s...'.C{.==.......[F...En?....,r..\.`(.m|.q..g.Npk.o.1........x...I....I%......:p........'C...d.Y.j......./..<1....D..<9M.V(nx...W. h.4GRo...Ti.c..A....O.\..D4u...I....J'...V..hj..-.E.D...t.j....0..0..t.."k............``!$.W... X.Y.).H..&...2.U....^YO.v....0..k.h...9.<}........2X..(..w.Q...h..gc2.\.....]/x.....b..}...5.G..!..y.........<5.4Z..-...q....z......XEH......W.....]D..)Po.k...@9......*6?....l$.....<.=w..|.p`x3...V....M.(..y.6...s.........I..e..~.......iU....R.7+6.....[.j@C<.yb.l.o~..-[...r.e.D.S'... AQ......o.PW_.,..>..X..,.o..e...j......c.v...e#0aY.x...>.{ES..|a....J......./..R..j.....^.0.ECJ....s3VJ4N...{..-..:P._4....P/...{f.g...e.H.....$..{On...........e...b......... .?5...O5.c.Z..p....O9_.%..AL. ...V..@M..{...Fd./.........h...:@...(@..N...>{?.Z.e......J.$.)5.*q...T...Q+G7."|.......4.....`.....z..e..vw&...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\tab_history.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2182
                                        Entropy (8bit):7.871959525865307
                                        Encrypted:false
                                        SSDEEP:48:roXG+Tqgihlr7uTJeZjuqGBeMdcfYSQInowB5SNpuFa5FEkNcE+krsUaMc:r7lS9afXFowiNlSacEdslt
                                        MD5:EA743BB14A4E4163525396D7E493851F
                                        SHA1:9E7D59B26AD3EC8514B5284314C10099C6C81AFB
                                        SHA-256:F6AA1E2287CBE64D4D3248DEB96EB506D619898BE1E4726A75565FC3148BABAB
                                        SHA-512:5AAE68B6CF0328CBDC0FD6A9D236DDE6375D82B11A34A98F9577CCE7A87199F969EE124CE5F82B7EB109BE68C723063778506D34ECD7AAD251010745A0E0F5B8
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq....MIDATx^.mPSW....$.I .......,.C..0.t.E..mgv.]....H;.a;mgZ;.S.e..3uwv...l.n...e..F+..6.TP.% o.BH...xw....D.r.....p_.9..<..<... . ..G.@...@D.a... ..@D.aN ".0w....H`[...4.*....p....ib.l.........M......8..Z[............5".".p.$`4.b.j.y.#.$E..R)V...T..E...v..-]79..)....~......V.!..x....:.o......BvJ:.e.#?5.K.1..&..h.n...Mh..X(D~V62R..... +......[.+.*%#(c..w...3.A.!7=....|....?...m.f...m..#....x..@@.....q... ...|........E9.y... ...E.....sS..W....O~..q..]W2.....X.'.g'..k..IL.}j./R.3...]}}.1.2.. [...,..q.>W.D......x.."....Ue?...u..&.._.."$+..<}...N/.4.:9....K.%...1}..$Irt..hK....F....!...@..M..C.#;..........<H%.[....J..EC[Z.....?8[...~... Y..u.._|.K..>........'..H..id..PX.9.#}...p...b.\...R...JlX../iy...H..lM......2.Q..?.j<......$......<...W.....k..0....F.?.....?....8......g....`..._...`.y<.PV..6....;^=..G6A..M.o...e..J`O.>..."-.]D.F..EGA[..O.7....3HMNF.R)s.r...z.=;+~..'B$....m.7..=[.....).B.Qw..\..,e&..!.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\tab_receive.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1873
                                        Entropy (8bit):7.847348495097636
                                        Encrypted:false
                                        SSDEEP:48:ack/QtTQik0K+GNXSwUmiK8OIkg+t/zTsFB8QHqMl7OW:ack/QdFK+yCROIkg+tbogQHqE
                                        MD5:759229A9E6A227E749479D3E38ACCAEA
                                        SHA1:59A1CF1616D6B0EC427E1D26A20BD3E5D17F0905
                                        SHA-256:F589CA31504FAF427C5AA7AD42E413D0808A4168CDEC02B09858A186460C1E09
                                        SHA-512:73090EB181BE0C3DD8961D1E96A8FB9E08F6CCEFB8A2AAFA3BD9C6D6A729396003E0B5DD5AF34A2D7CDAAC786E566B2E6200352EA826ABDC6A402C2DD140C67E
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....IDATx^..O.U..g.e...-...h..G...|..6....5e..iRM.&.&j.J.....&....`..6.P-.4&]m.1...J...X`....2.;...j.O.=w.9..g.C......c.....s..[...p......h%.-.c._b.y...b.[R.x..3.to*..`..H.r...X.X J.....I....O....q.......~:@DGS..v..`.\.;....W.R.A...,.HI(....m..H..G=.........<.^`...J....O.....(.!.../w.|.a.@........MK...-..i.... .f%.?9=.01u.,.w........86Z....a...j.......iY....I...f..X..-..:A..{LN.`...V.3..N.o.. ....X...../...g..G...0.b_W.kCz...1.@..u7q.&@./.....[...5..kw...}.>3I{....e.kA1....N".N_8......a|....?..1m..>..*.l.f..%.........O..............m./..g]...^..+7./.Wn....W153.....m|..{?.)..S.t.`..6..1R.........P.....>."....#A..5..x..2...N....zo.......@,....@....z.0c..t(g.l$...`.......0... .) ..F.....P.m.v..*9......f8.|s..^w..C.:........3...}@z0.L`...<...#x.@..KW....*55$...@r.....K+.K...?.Ba... v.i....|......`d.o..a.|......Xd..;:.z.Y4-C .,5.c.Y...t..oZ..I\d..{#....>j....5..|."..L'....W..#(@.UE...=_.......A..Y....e..Hx.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\tab_send.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1550
                                        Entropy (8bit):7.801347642580139
                                        Encrypted:false
                                        SSDEEP:48:P/pJ59aQ3CDH4Hr5r34AkCO7uN9fpsTrq:P/D5913oHOVrocUufCrq
                                        MD5:60E2D5CEDD24680A2ACE067443AD2621
                                        SHA1:2E262FDB4BAA4F0825BE04CBD2F8CA8C2E0AF791
                                        SHA-256:FD2BEBD2DEB05AA9A4EDBCF112A42AE2AF4E40608D58197A96AE2EC15F3104C2
                                        SHA-512:29708A046E52327A79D141056D1280878672976A863D7A120A5CD13D78B6D1B02D83C6D7776B03F772E0837FFD1BD1FA60BFC5B0B8D042B48D761B7454FFC106
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....IDATx^.[L.U...gw...[..z.n...XJR....J.h.I....]..E..L.(....|....hb...bL..6`..@..R`K.r..9#K.ew...v.v^x.3.|......-...!..Q......DS`.. ........].<.O.[*.\>....k..O%@.....m2......{...d...|eN...|...;......M..pA.qwp.iI...(.w..sN.@3>:...^<.a)......1..f...1.4va..1....d...@&...1..[8\..X.i....k...E.8.....-.C.B.Tg..X. .N...t...W..;.C.."c....c..X...N......s..?....X.2y."...a!..8........kp...(Z.....w85....... .....%....P.%3......D.5.N.G....A.xez.^)...n.~2...C.@.8.lhxR..{C..fjb,..]..1..;...(....Au...V.I.G...].cey._.G..u.@.8..;....q........*..|....QX+..#..v......@..>...K....Z....Z.i..cN|w.....f...\....Ex....E.P.i....q.+..p.....2l)\.....!..*8......\.N.f<ykRQ.=..>..k...8-^....\..?..../.....<i..*.x...G.]..{.Gf.''Xp.,_v...H....E.y..A..F..nd.5.>..#...83..C.?............F..vk.]i...~..H..z.KK.S......H...aU..zA.i..P*^\.BCKO.O.....Ej..i.W%.m..M.2.pV.8....x..s?.'.o.D.=......~T.......o.".....(Z.......@.)..o.".]..d..e........K...E0.e..3

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\tor_logo.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2712
                                        Entropy (8bit):7.897509548266366
                                        Encrypted:false
                                        SSDEEP:48:OBYh6wWjHXqGQla23JWOxBqj3taKc6U6pt8XCFPPJsKfinrJHO10knEmRXsHr:OrL6rla25WOxBq7MDN6f9x2KarJMtnLo
                                        MD5:E984E43EA26ABDE50C0679243413BE73
                                        SHA1:1CDA2539FF5AFEBE8B0240A7A53CEC96E59166BF
                                        SHA-256:D3B9D45B853AC0ED8040743435131943A290BF477F84FB596C3F1B1788CFFECC
                                        SHA-512:E751D281C2E298FF38B756BA93EBBB3DC355A73DDE2460A1AC9E9EEB9163C2558E7399A5A0BC8441DEED2CC1F068980B8F700BA03E9FA802B117D0C7CCDB5B4B
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....gAMA......a....OIDATx..[iPS..F...T..HE.DCN..e.(.)B.D ....&..Q.m.."*j...X.2#Ej...Q+.Q.*..T[l./s/3....yO=.IH0?...7......y.wy...ttF...q:cy...u....#..#...?7._..A.#.......g....}v......k.K..o.=......Z.)zs...:..to..m..r.1......|...5....R...n...=.p...[..5s......7H~. .H..ZC...M..."_.L.|.....v.............;}..o.j.k....;.x.|.U.(%.T.]..?.Oq..Pt..j;..5......P.dT.&.k.1]._"....2/......;..9N....5.G5..j.y\.'Yu..X...Y..R....H..`.K.g..g...=$oo.u.O..X.q..].d.!q.....?../$..T.6...V;.....o..L..X)..4....&...2.P$.59i.l{..)$.0....Um.../m.6.:l;...A[.......7...9gl.Y%L9.D.-d...,.].J.=~R.u...o...#. Yd..V.B)dGY...&...\&..ZA......q&s...U.zzSP.....^J...+../....<yr..Y.K.X....'...=.\g,,..T....^.:...<`..L.....?q<.}..f......"./..B..N...3p..5x+.v..8..t...........{l..d..XQ......cC.GG.FE..O5B.... Y...gd..Q...h....o.[.n..Bhf6......"x.e..../W..].......h.w]......\.<]...............l..}b|B.=........../#.(@.........^........v..G.<......}}"9.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\trezor.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2606
                                        Entropy (8bit):7.87590276765234
                                        Encrypted:false
                                        SSDEEP:48:9GyHy2I0ptxc7rfVIZzhMUinp+mLxU7bM5fPfN3bYgZUdyXcj3:pS2NHWrfV0zLinp+m+7IBZbYasr
                                        MD5:BBFD133D7E3BB9166A72AEFF44039DD0
                                        SHA1:B793265348BBC090AF7B9E860FE08D75477A9F22
                                        SHA-256:FBC9CC7BE4BFBC63D013177A8D5F6D45E5B803F3AD18B9D3F06ECE241387DD4E
                                        SHA-512:69787575A49FDC93AC08F0E19FF138DE9A8267A95A6D6809F90CDBDA34E511226F397B860C9BA66A2BB39A4CF2117F3939723866C119BF1BCB560C03741F8B4A
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............bKGD.......C......pHYs...#...#.x.?v....tIME......8X.<8....IDATx^.kl.........N.b.DmM.`S .K#....m.u*.T....j..-Jc.J..AJ.~HK.*M..U.xT)`.A...VI...h(...[...l.w.k{wo?...].xf.3.......{=.9.u..f...,........+.%......H....x.8......u...C..`-P.|.....L.....^.-...{...ow...F.(p.H!/o7..A..@#p?w.K....L^8...~.....Cy.....\...._.[HWp.!M....:.t.....Ch@F../.....s.s......N=.7....#T..bz.K.3.......4.k.n.7.!..@.H.#.i.P.=...<.Ly\..,.M.._A.|VP@..W...9D.A..V!+....".n+BjH..G..&yg....7kb.i......z........0.y..._A..y.\.OX....Ad.l....HS7.C.....f k....K....u..R.<...fu%..0.:{F...F..f/.>.E.b,.!ducf.)..(./&w..2..r..w...s..qJ.......^\...[......2..7`.....v.L@..6.4Y....vf..#.Q'..t.f..2.L..)..`..2....`..X..ADt....0.>..cw..e9....)..Zf..Y.s.3a.~.N.S...F.`..u.;.6b../C.t..q8..2Z..k...d_&`.{..S^6..1. ..%.%\z.v:...).A..x.&....:U..\..,..~K..X0..g.f..Y.sdV....0Gf...;..;X.......S..p.8..M.>d_..f.s...#....f.]....K.A.}.f.\d...DrdV..q..O;.P.,.....X.v-ee..s..........9{.......in\..m..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\trezor_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1950
                                        Entropy (8bit):7.797132462932182
                                        Encrypted:false
                                        SSDEEP:48:9dpnb/9pz2F8k60ff3UDxvElEN0qaJQsAhgFYQ:npnp1OUDxvESNKehg3
                                        MD5:DD744CD63E82BF20B1869CB2574E26EF
                                        SHA1:C0AB173E75DF598D98B6CE2576EF01DD0FFDC6C3
                                        SHA-256:CF02055B85C86E9C962C3A9CDA299D90A378364EEC244E31ED5A17EAD2D84C81
                                        SHA-512:28B6503F1CDC9620BE79C5764063576FBF3E15E3264ACC0A63E9DD6C8A83EEB61134A2949DD7362F2BBB830DA0CF4EA7E38D19D1768F99149AE831352699D962
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............bKGD.......C......pHYs...#...#.x.?v....tIME.........L...+IDATx^.[h.U.....4.D.T."...".[+.mFQ...*>..Q.... ^C..}(*^../U4.`E.^......"D...hic..5m..._6.nf.........s.......)T.E. D..f."...l.T.x`.p...v....&.W`.M~e.....Z.%@.*.4...;...v.?..O.m.........{....^-.....+..8.8.x.........u@-G)....c..).2.o..hUp..CC.'..:'..t.39J..m5K!^..G.z*.E.7.V.....Q..F ...<.em.p9% .+.....{.....v.. ......Q'..%..Oh..x.,.v........./.-.x..;...\.\.v....C...w.i#....M!&h.....4.e6.i...k.~.yg.....V.'.......A..^..<........b.".bt.a.....p.}6F..O.u........gG....:.7}._.....tttc.....0.>............h..?.I.S.....K(..`7LG...B.@..oH....D.<.DS.b.J....3.8.N....hu`..h4%*......L.!.......k.5......1...G*..p.W.#.....*.O.....dB.z.K.S...N...../...y....8..p.4%tA.....<....O........d.!\....Le....u...PQx.@.].B.}.X.+.,.......(U.}R..'U.}R..'U.}......$a.D..H.....+b..].>../a.8....5%..&t.."..]..3%....]mD|R..'a.p.,.1.H`Y....46.........Kooo....v.p.B...i#A../u.#TD$!".ccc..."

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\trustedcoin-status-disabled.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 50 x 54, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):19933
                                        Entropy (8bit):7.574534972019669
                                        Encrypted:false
                                        SSDEEP:384:lo1/vtK7MqGFjjvOBncKJ3aIXnXlyY7pZnwVAreANbBk2/urYl:laM7zGpN+aIXnXlyY7pRwVAiIba2GEl
                                        MD5:64CDD6A1BA368CC80D4722DD87125C2B
                                        SHA1:CF9F64404F9422B5722902909279B3D47F0BC5E3
                                        SHA-256:F48994C54E979CF844F8E47E0FAA309E45206FAE81B8B28EF26AD3A703512056
                                        SHA-512:D57AE5788EF747D55D987FD335230666F7FCFF12A37FB217240AFC1DBE9B0797EF0A28C0D17086CC38FC054B50D64D05AFE6D0490AB8C787EF524061244A1FD6
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...6........../.zTXtRaw profile type exif..x..i.%....c...L.a9...-_.Ad..j..."+...F ..38............./.[m....'.........;...~.......T~~..Q.+..m??..~.~_..2...v..~~1............F......=....s..=./..?.<.......N....a......6.b<)$..1.o.I.E..~....0.....R.?.cB.m.~.....P....r..........K...\~....`.."..O...s...............v.3..#....<.Gy...-t...Z...K......P.~...z....9.0...}]a1.....ob\1...Tc.+}..pcM=..X..'~...%..v..[..;....XP\.......{..A..~.q..f.Z9...X.p.&.......?Z....fY)...]bZ....[....._.......qkc0!...ZH.J.5.....X...c.q...,n..s".jlQ..-5..F....s....TRemz.,V.F....A.e3+V.Y.QR..J)...GM5.j..Z[.u..r.VZm..6z...^z..>...\y.....q....Yf.m.9...UV]m.5v.i......{.p.....r.i..q......n.......j.'m.....Z.Y..VJ/..W......ApbZ3.,..X.% .....s..i.|.d.E.iZ...b.`>!......oE.r._..j.....sZ..p......m..z+.e.&.'.o.......W.}...V..R/L.M..[.n;..v...Z.#..N....#......N....Q:..y..;[.'..}....S...]..k..{.......{.....,Vn..^.............\...Q...........tk..F$|2a:.l5..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\trustedcoin-status.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 50 x 54, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):2034
                                        Entropy (8bit):7.660239465649274
                                        Encrypted:false
                                        SSDEEP:48:0li631SscJ1VE7Nmo7qs4Q2Q0ZfoekC7XHln7tT0ny5SLsE1Abr:0LFXczVaNhSQ2Q0+eX7DZ5OQ/
                                        MD5:2BDE89330B50F80C329AE96218ED4407
                                        SHA1:808B69490EB31F7DDB389C40C873A1DB3AE072C8
                                        SHA-256:59483C610D70606C486D6124BE50FA8FF11CD135A8C9E01A23FF6B6EEF34AF0D
                                        SHA-512:E0BBF4F3D7EEDCE48FCBB9D8AB40097BD56CB6EB49F257228CC96F05140D75EBE8348E9EFC840FFA8783B9FE1EA104EF51C58807DA21F212FBF15D961810AD39
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...6......p:.....PLTELiq................E......................T..................}........2......<.J.............,. ....z..`...........r.......V........v...6...........}..............H.s..................O.7....................<}....Q..N........................6.............F..................................".................................................................3..............;..<.....-....3...........*.....t..........!........M.............:...........g.................].....H..k.....T..!.....W.............)........l.....:.....a..t..s..%..5..=.....G.......z.....;..@..m...................o..S....s.........a.. ..........................O..b...........].......B..f...............J..........."..I.....J..........P.....|..w.....#..s....P....ZtRNS......$......9@......../D.N.i.r39.....a......F.$.....b...\m.g....>..7.d..d#...Tzv...F...(......VIDATx.....$I..s.k...me.l..m...m...t...55.......2..#......6E.C#f..b........Ggc.I+f....e....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\trustedcoin-wizard.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 78, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):2206
                                        Entropy (8bit):7.856793550146874
                                        Encrypted:false
                                        SSDEEP:48:RtLYoH20oBpJMBYgo2ZYvCifHAWvJRtt+y5a7+ZN:/8oHNyG9BYKiPBJRtt+OawN
                                        MD5:4319812521C3BBEBB5A1CE0921C67FC1
                                        SHA1:23E7B2283D9B181ABBCE90808F1175CD39BCDE66
                                        SHA-256:F4FC9D6E66B0C812F34854C5047506268C16B861056DF140535A263A98B6281F
                                        SHA-512:6FCEE42CFA23683F3DFDA3D6BD6AB8242ECF758BCCB7CA59B8A7E60D1173FCA2F1F420CD4E277E904AB658781F587A2DDA3887D61EEC42684E511C81B53ED10C
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...N.....K.....nPLTELiq......[[[Y^b......C.....K..............\\\...................................]]]]]].........XXX[]_.........ZZZW\`]]]............[[[...TSS......^^^]]]......`[Y...[[[...^^^SSS]]].....B....]]]...F...............................5.....F..-..&..... ........k..N.....\..............p..;..............@............................V..........b........z..^^^.H.r...EtRNS.%.;.-.....h...Sq\.q(.|..J@.f.......FP~C<..N........E.t...6:.:.;.b.4+s....IDATx....w.>...>*3.v........H..:.033..k.q.Wn..[V.Y...2........>.?.....|.....VoIn,}..*`....M.G....Hi...`h~yc.Zp.......#.._....&..~....G,n.y...pc..._,P..=^S.e..N........\.z.Z_.d.....,JJ.D~..Rl...~".b*........(..BC.].r.+....TU...&|..sFn.~O(^.+.)W.%BEO@..L..[....oF.$...r.N..j.....~.Jx.....N....2.....[..7.......'.....c.....-U&.....).l...Q?.(.#......p....9g.sx...rFA.......1...TUp..........ef.qi)i=F..o.......-QN.....FL..D..m.9.S.7.m..J....hTv....+....r......Z.:..j.8 D...r...p...a..X..X

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\unconfirmed.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 100 x 100, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):3532
                                        Entropy (8bit):7.5891737213090185
                                        Encrypted:false
                                        SSDEEP:48:f3QHXMNzJUXj8XPh3otxZLXjnoGbx2qXMhgkgbSBAvdYKeTJua1xTXhh7s/q:vQ3yqA/h3otxx8s2GJdYPuaF
                                        MD5:72677CFDA5DD751DFD4E1077ECB499A3
                                        SHA1:F157E625D084EE85E8028230C6BC9E002CA86391
                                        SHA-256:A3C8EAB530A557686719B32027753E6CC6B0DEE76AFB041FC01951A8611B05D9
                                        SHA-512:D6B9CECD94973BD79868C833CBA45C7CAE9D6485205FA8D70EE031F4F596B74BD7A4909FBD256F4ECA932FBF124837DD9740FBF6A45BE93E95572819C7A532F6
                                        Malicious:false
                                        Preview:.PNG........IHDR...d...d.....G<ef....gAMA......a.....PLTE............................................................................................. !!!"""###$$$%%%&&&''')))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@BBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMOOOPPPQQQRRRSSSTTTUUUWWWYYYZZZ[[[\\\]]]^^^___```bbbccceeefffggghhhiiijjjlllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}..................................................................................................................................................................................................................................................................................................................................................................................................................................8.W....tRNS...................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\unlock.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):45956
                                        Entropy (8bit):7.971545234009563
                                        Encrypted:false
                                        SSDEEP:768:8k9/w9PXN26vaXa92He7owtuKnMfAgqlQNkpBM2arxIJOaLfPtWfFMlHJLw3/Z:8k9Gd26vaQ1PM+QNUvIxU5Rw3x
                                        MD5:EE2E1C80E44FEBF375BA777918A9FB4C
                                        SHA1:138DE76DAEEF169D9FDC9E332B4658B010C8C65E
                                        SHA-256:AD0BDE11FD020914782CCAFC15EBE2C9C01F28D262E51CC8983DD79D8D9DF5E4
                                        SHA-512:C926201F15F64954B4DB42C6C38368A4C10BA641AA2559C49174D09179648697966C48F6409E32773AEC60F21088ABCA89CBB75EBEDAE94CF1DAD6899581A798
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...y.%YY.?.efUVVuUuW.;.8......*H..4*......7d..b.Q......p.....(.2..#......]]kV.v.8..sN.9'".yo.{3.Ow.}.q.w9.!..01...G..qTu.Q$t...3V.8HDK.^".........&.....`4..h....KDk......4.G..."....b.....^m......y.s...5....M...a.y..^}...k.u5..g.5L..X].......(...u.g..a..1.e......y..su.?...<;....... T...j...........[.t...i........>M....b......K^...>8A.WD..}..'...P..../.....U.>.9.4.O..#.|....o~.?=.)OI.}`.0.....W..U..4}.4}........g......a....A../^.|n..%.......y.._yK..M..&.....i..>.K........w..8y...f.a~......y.k..:.k0...o"..i..P...?............$......'x.k_{+.~..O".Q..i..04.............$"..A......W....0......C.}<..........V....Z....s..w.}.F.{H......>.a.b........._M.`.a......3...(..?..?j~.c..o..3....H..b.'....";.(...f.).......0)..S EPJ.q..RHT.R.D%.4..(.|0]e..=&;->..BP.U..p.$v.....343.5.6..._.....H.4......a......,....Ms

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\unlock.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):19461
                                        Entropy (8bit):5.028084132524802
                                        Encrypted:false
                                        SSDEEP:384:sbom6MkCX9CwqISAHSc/8EqFzvacL1a2oJtcLEY:s0Tc1/jsvacQCLP
                                        MD5:9C4D31CD803676CA56DE268BD1AD7635
                                        SHA1:823208D92351211A5FEEF301D26E62515EC1939B
                                        SHA-256:75F4AAC7999FC470270A75BDE3C73870C9D8E235CC40AED0D04830B46471A30F
                                        SHA-512:E7DA269DDCAF8B1B37C28C0B39B6A33D1D46022CE12E38CFC81B4D8D7197FAC2C7CEB8AD134675C0D7E4C8F0F8E5B21FE51999E28F860A60AEC6868B18759EFE
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->..<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". version="1.0". width="512". height="512". viewBox="0 0 22 22". id="svg2". inkscape:version="0.47 r22583". sodipodi:docname="unlock.svg">. <metadata. id="metadata58">. <rdf:RDF>. <cc:Work. rdf:about="">. <dc:format>image/svg+xml</dc:format>. <dc:type. rdf:resource="http://purl.org/dc/dcmitype/StillImage" />. <dc:title />. </cc:Work>. </rdf:RDF>. </metadata>. <sodipodi:namedview. pagecol

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\unpaid.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):23805
                                        Entropy (8bit):7.980170255740335
                                        Encrypted:false
                                        SSDEEP:384:j9adJPzcKTRQo4DDo4UBlXLP2NuEuGFP6ZvQMsY4bdn+FrBXDwlZL1yDDqOxJ/tL:g5zcKTKFD0rXKHBw/rSl1k31RaGXUm1
                                        MD5:C1AFBC88ED47F2FFF0C8B0E9C93F3B60
                                        SHA1:71EADE1D4D878BB80FE469D169EBDAED81342A23
                                        SHA-256:FC8EB93843F5D2933F409B4EB990F802B1127663FC1558BB50B9F016B05A7F1C
                                        SHA-512:FA4B918E81D56ED7A0220B4992DD9287A2F100E7FAE28294E5ED7EA488EE9F391070FB2D3B643F6A750857AFF64D74A769F0C867B416ABD8169CD7A70EF614DC
                                        Malicious:false
                                        Preview:.PNG........IHDR.............<.q...\.IDATx....U........kw..v..k\;...PP..AJD....E..D...*!(..X..8......}fo.....c?.{.>{..b.]_.7..b.......N..+.v.a...n..n..byyy...w.9..6..*U...u.]c{...w.m..g.......*V.h...o.......q,....e...[.9..~......;.......4........U...cu]..g.'...c....j...A.}..'..~..e.=.L.&...*T.....w.M.7>.3......;.h...>...|[.9...|........<_.r=...X.z...G....}u....O.....}.ca.....G.;.t.i}6X....{./.N.....v...OJ,....?w..u..i...%|'..o...%.,.g..}..C8...5r/....J,a7.s...[...w..L...za.0Z.y.S.i...A.*j...>'.......H+...xF.at.F.m.k.C...?`....^.mt....].D.X..g.}....J.......}IX.Q..... ..e.{K&.E..C.5..s.9.S.E.]dn...S.zuS.V-S.n].A.s.}..{...u.]..[o5.....Yg.e.;.8s..G.....G.gt..|....M.X..9Q.....&..L,}..}.W.....J.0:..F.....9.c....cG3|.p....3f....E............_~1../...._-x...~...\......3S.N5.>......W.......G.i%.d.:.r..L.>M.v..u.......1t.j....U}...N.......T.b...J.ys3v.X..G../.............@.H........l....O?5.g.6.f..9s...?..3.._.o......A..K........}_|.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\update.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1580
                                        Entropy (8bit):7.778938064983873
                                        Encrypted:false
                                        SSDEEP:48:iB4tZ84cyC86IswaNFeUd9gcBTmPNv1K1z+t9MWDCU:3Z8DySIsbFeUd9lYU1yIWWU
                                        MD5:821FECA097D7DE35F0EE7D1C0AA03635
                                        SHA1:88803F1BBC066A6A6BE8722610AD3236F06E20BC
                                        SHA-256:D5A0ADA0CFA3837F27FB804582BD5F42AE60DD3A7EE58A51775EFAAC44A2C262
                                        SHA-512:0F6ED76BD84B055C7269367813D07235E7A77AEF70CBF9D1EFE9303ECF87C3BCE51384B25E50942BA233E957B14EAD51123E3786B23E763A90298C96583AE1F7
                                        Malicious:false
                                        Preview:.PNG........IHDR...d...d.....p.T....sBIT....|.d.....pHYs...........2F....tEXtSoftware.www.inkscape.org..<.....IDATx...]..e....3....;3J~`_d..D...9G[)*lSB."...... ........(....>......... J.#qf..7w..O........9s..].....g..y.}.@.!..B.!...i.=8.:....*..*.YY....G....L........%i.KC.7....~gU...+.......!.@i..l".....4.!.....e.m.C.. iH.DX..;{N..7.T.4$6.>\..w.6Q].......A.....x%......;.b;.......=.U^).VW....g...&.!......LY....p..b....;...6.V..h"ufl.JAo.B.!..~w...L.f..g....fPPqw.a..y.].X...1..z.....<...$.U.}B.~w%1..Y3.._[V...0t:.2-.......f\B..D3......w....."..]-v...w...X..t.i....6.^gi.lC.....*t.3.....;".v..6.#.7Z#...u#.4....b.j.:....7..cD..-..t...............jh.2.A.Y.E|y..k.......Q..W"..R.F.l..... .A..W...ot;r<.m.."W../.p.W...]:...".E.&..z....NDv.cI6cD!...........N.L.d./+ot..QHC.L...4d|.g.(.!....E....R._.Y3Fj(i.)m<v....C?f.^..B.!..B.!.hf....Vf....f.....D..g.36{. ...er.=.8.(.w+j.......P....uJ}O=.......3..<H.!A...@/dcl\..b..mA.......3...k..*|....Z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\wallet.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 49 x 44, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):824
                                        Entropy (8bit):7.558816816333435
                                        Encrypted:false
                                        SSDEEP:12:6v/7mYMC2s/6TbRBtTgRM0I6IlqsRt4CUMQL8rCeIlEm5SQlcjhZ0EtniYerognT:HO2s/6fRXHYODt4gQ8mDlcjdtAEIH
                                        MD5:61F57C284D23775E1D16EF041BB07A9D
                                        SHA1:8AA2AE436DD6365D8AE600DB715760C57EFDA20D
                                        SHA-256:BB8B3B769D9E22053F3DF5A842A48D21BE6E1659D4DBEF7E09F4AB5EAD7EF509
                                        SHA-512:A1EAEF3131A82563607C149421712E3E9262726442B6B62322F05B510010696943A296ADB3214CCD3B5DA3E1B5F6B1AD9F1473D7AFD80D7D1E132BEE5B251751
                                        Malicious:false
                                        Preview:.PNG........IHDR...1...,.......PY....gAMA......a.....bKGD..............pHYs.................tIME.......(x.*....iTXtComment.....Created with GIMPd.e.....IDATh..?h.A...7..O.1.R..!&.L'iD.(X....b.!D..l..L.&........A..J.0...X.B.d.....'......$.....m.WM1..1...f.;.6...6.m.QSJ.l.W...L....4.!....+`j.........h.3..<2.+..r...Z...F%..s}]O$,s..M.h..p....@r.l....%{........[....`L..6.....C...r....}'.....<.U.....;....5.N.s.&.6.0:.?.0..R.]+4.zb...J....)F&..v.Im...@..8l....`.a.....E......eo....b-.....P."Y....2NZfWU.....F...$.a..^..Nn.B.".O,.<.Z...&.MQ..9.Z...#)..$#...#d.S..a...-_Qt.j..J8...d..U3.T4..../C....2E.)mu.UM.......\....w..N.|7....A...6......a.#...`..>.)./..%........;..G....Q.C'..d..vt+1/\^.l.{B!.@.fk.%2@y.=...1D..C..1.!R..K........B....-.a+3qr...B...G....$...2Z.........8;5)~......Z`.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\warning.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 150 x 138, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):4839
                                        Entropy (8bit):7.937332736620083
                                        Encrypted:false
                                        SSDEEP:96:MKNL4/3sotYG4AcBAvnnuFuNIZY3gg95nqItMewv7EOWTbZwZxeTn08FunI:MKNM9tYB/BAfwY3dnqyMpv7BEa7eT0/I
                                        MD5:C1AE18250A3845EDC5E015F6FD7932C5
                                        SHA1:FA5FDFE17E4FB0A9F2CCAF4BDCC2FF75B34BC94A
                                        SHA-256:541AA0FFC78F1B11C16ABB5AFE51FA1465D383EC4D867981D6275838F526D0F1
                                        SHA-512:19726DF6BD213F4BE99C4EF0585901BFD0A2DF7A174F17B71D7D1FB733E8D6CED2A105090CEE71DDC0E9FAF3AF6DBA43F17D2E00F5255E2B2FBD209F867A1291
                                        Malicious:false
                                        Preview:.PNG........IHDR.............H.......bKGD..............pHYs...D...D...%.....tIME........)k...tIDATx..{x.U...U}IwB:.Iw.F ...`...P..../..#.xA...../(...".....0.....<..:..w.G.G..../,..(.-.N...A#.O.........?..>U....|...|.L.`.......h...[.e.`.D&..-...g+Pg...d..I..3.4..p.....T.>.M....+. .O.iF...E.R).F.&..o..K..4.i.`..Y&^.V^Z.UY..T.^fW#..IM.../.U.(.=......b.U.\We.A%.SL...k,.Z......../..0..:.F...F....m....%eT.m'...*..r.]{..j%.....F.3.T.E...'.!.s;n<.d..R....p..+.....ux}u9ng.g..ge..&>..I4LW.L..9X'j.4.C..v..-...].6r..+.0..[..G+"2N.C..Ia.GD......J.<"j...Bl.._....B..a.AdX.M&..j."\.;......)Q..Ua..".^.Mb.7..5.]X.G.Q.z..........x.X..Rc:.5.......G"...6....xF....x;.n..U....A../....f...+} .q..GuU.Zfd.....4=....X$...W`.._:...4|...b..x..X..zQ..S|.dkd...?......ez,.c,p}.Fg...k.!......M.......}.U.j.LH...........%...U.R.1A.rq&.9.....HUUn.1..\9....b.^..2 .0....6.Y-92.}....VQ..HCU>.=.JQ.Cr..;....3W4M..;.\...G*p...3U4MW....q...=Iz...Y}...0.m.6=..q.....?I2..h7hM....6.D&.>e....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\gui\icons\zoom.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):11786
                                        Entropy (8bit):7.957478228690459
                                        Encrypted:false
                                        SSDEEP:192:aekmXwVxRBdZ35KCHx2y4g4574thRlIUqh+4Nrv7YDOXOXxlbveDvfw2l:+bbdZ31HgPt574/RW5J7KOCzzivtl
                                        MD5:A93A6C2050830B2AED471A666DD5F52B
                                        SHA1:34DE9BB7EDA8B291820622089D5B4DDD3B8ED70A
                                        SHA-256:19E15596D401E2D0DC227F5DA3B04179555E449B1C6D7732514B336589D4D713
                                        SHA-512:91C96AAD3F90A786F60F3B3C323297BD0E7341ECB0AA47CC85E5E015DF3112CE97EDE28D74FB33D25854782918FAE1D3692B06BE6E07C5352D62BB3951198A2E
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a...-.IDATx..]..SU...i...L.Q.20.^.E.ba.\u]u].-...ZVEWT.E....b[...DAPA.4.......{.L.....L..^&.e.9x.....w.{.=.^.zH..XK`-.."XS.\[kl...._u..#.p..t.R......k...)u..gl.Y...].......,..6...\Q#. |..W......]n..6.......B`X..*.\u........k....tg.$...-b.....K...Y{..1g.a.&.q...App0.....S.....6-.r...FMu...N......9....x......T...aD.q.....rr..Ov?.e-5-.j..1Y!j.<.......8..?....;w...m?.sN...GY;~........B...]]..<n.$..;......f;.........n...W....G..j.......v).`&kKY..wQ@@ .N..W....$Y.z....5w7.)YsS...(.....j0.....=...r .o/>\..|..'hnn._......xh...h...wQ4..7...L..Jx.Tf.(.1J%T^..Vy..........?..^.A...6.........._}....]}....q........?....$2.n...&N..www.Q...1.W...7...<?..t $.V.....V,7.....e.......3..A...n.Z..........a!....F....nn..q..?|......A.....&;.).L.n........ .CI.1j,...}...7.4b|p.?g.....Jk;......{.c..r..P..~....D.DC..&...F..........;3.4A.....v..$..R..2......-x.4x......v.'bK.|.gI...G.....S..i....1.pv...U.....i.....]...q...xT.<.-...3 ..`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\lnwire\onion_wire.csv

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):3121
                                        Entropy (8bit):4.799864332727764
                                        Encrypted:false
                                        SSDEEP:96:IzHLC9LgLZWLCALhG0Lro6euCNAQhqQWLeL9Lm:8eO2GWjNx
                                        MD5:E384DCF371DF1E40CE76874151812EDD
                                        SHA1:434042DC2F8ED57D203BF1B950091636A84EB37D
                                        SHA-256:2DDBC1FF1B9EC2E7D2E86E50147A3E61EE569D53E8E097633A61A7E18A9CDFA4
                                        SHA-512:DA43A8CAC8020AE237E0E3D9B6B91594E9C962F2F4FD05AFB92F242BC00C265A0D0798010F72985CFEC57962146E1C5D02BE59D7B944386617C5140AFC3B1E51
                                        Malicious:false
                                        Preview:tlvtype,payload,amt_to_forward,2.tlvdata,payload,amt_to_forward,amt_to_forward,tu64,.tlvtype,payload,outgoing_cltv_value,4.tlvdata,payload,outgoing_cltv_value,outgoing_cltv_value,tu32,.tlvtype,payload,short_channel_id,6.tlvdata,payload,short_channel_id,short_channel_id,short_channel_id,.tlvtype,payload,payment_data,8.tlvdata,payload,payment_data,payment_secret,byte,32.tlvdata,payload,payment_data,total_msat,tu64,.tlvtype,payload,payment_metadata,16.tlvdata,payload,payment_metadata,payment_metadata,byte,....tlvtype,payload,invoice_features,66097.tlvdata,payload,invoice_features,invoice_features,u64,.tlvtype,payload,outgoing_node_id,66098.tlvdata,payload,outgoing_node_id,outgoing_node_id,byte,33.tlvtype,payload,invoice_routing_info,66099.tlvdata,payload,invoice_routing_info,invoice_routing_info,byte,....tlvtype,payload,trampoline_onion_packet,66100.tlvdata,payload,trampoline_onion_packet,version,byte,1.tlvdata,payload,trampoline_onion_packet,public_key,byte,33.tlvdata,payload,trampoline_

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\lnwire\peer_wire.csv

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):10291
                                        Entropy (8bit):4.483106197219259
                                        Encrypted:false
                                        SSDEEP:192:IYxDifBpiEumGFA0OpJLGYYcRwaiGxyz47omSaIuGcByWyb3t:dVEHLGYj7lbIuxByWyb3t
                                        MD5:56A2D1E3978C5FA6512CD9A4AEE94E4E
                                        SHA1:E5343179EF2B850AD95956A1723B7191B4E800A3
                                        SHA-256:8BF80CAB57F38296474611AF11C116B34A93AECF8575F0164A9E886B335D2422
                                        SHA-512:7B3DDA9E17D6E1ADE902D807A17244FE4540063DFCBC12E65FECB183D9B9462812B18C0D73DC9926E00BCFD5D8342D7C588725D94ABB7425A98587DADDF88828
                                        Malicious:false
                                        Preview:msgtype,init,16.msgdata,init,gflen,u16,.msgdata,init,globalfeatures,byte,gflen.msgdata,init,flen,u16,.msgdata,init,features,byte,flen.msgdata,init,tlvs,init_tlvs,.tlvtype,init_tlvs,networks,1.tlvdata,init_tlvs,networks,chains,chain_hash,....tlvtype,init_tlvs,remote_addr,3.tlvdata,init_tlvs,remote_addr,data,byte,....msgtype,error,17.msgdata,error,channel_id,channel_id,.msgdata,error,len,u16,.msgdata,error,data,byte,len.msgtype,warning,1.msgdata,warning,channel_id,channel_id,.msgdata,warning,len,u16,.msgdata,warning,data,byte,len.msgtype,ping,18.msgdata,ping,num_pong_bytes,u16,.msgdata,ping,byteslen,u16,.msgdata,ping,ignored,byte,byteslen.msgtype,pong,19.msgdata,pong,byteslen,u16,.msgdata,pong,ignored,byte,byteslen.tlvtype,n1,tlv1,1.tlvdata,n1,tlv1,amount_msat,tu64,.tlvtype,n1,tlv2,2.tlvdata,n1,tlv2,scid,short_channel_id,.tlvtype,n1,tlv3,3.tlvdata,n1,tlv3,node_id,point,.tlvdata,n1,tlv3,amount_msat_1,u64,.tlvdata,n1,tlv3,amount_msat_2,u64,.tlvtype,n1,tlv4,254.tlvdata,n1,tlv4,cltv_delta,u1

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\ar_SA\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 470 messages, Project-Id-Version: electrum ' (\331\204\330\247 \331\212\331\210\330\254\330\257 \330\263\330\271\330\261 \330\265\330\261\331\201)'
                                        Category:dropped
                                        Size (bytes):40209
                                        Entropy (8bit):5.39847839032353
                                        Encrypted:false
                                        SSDEEP:768:GNyUGMFYCcntm+dE+qCXwh75pLmi7KUOj:8yUvaFtm+a+FXw977ej
                                        MD5:1494DC7A2CCDB6723531124F3947D502
                                        SHA1:C08D9607B8E580961098617D482DE8DB7B02B7EE
                                        SHA-256:E75899862A93F97838047A8B8727B3B5267B7603FB95D522139D8906A723DF36
                                        SHA-512:D226B66A18711C6238888E85AEA87DCF937FFE4FD84D3D2B30575F19E5019D5A683B57036808BE43292B496B9575014683FD2338F913D1465CF2D5CD5FFEED36
                                        Malicious:false
                                        Preview:....................w...|.......X'......Y'......r'.......'.......'.......'.......'.......'.......'.......'.......'.......'.......'.......(.......(......$(....../(......:(......O(......U(......](......j(......r(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......).......).......)....../)......8)......?)......F)......L)......T)......e)......k)......r)......y)..K....)..0....)..m....*..#...o*..=....*..)....*.......*.......+..0...)+..4...Z+.......+......2,.......,......>-......T-......c-......o-..'....-.......-.......-..-....-.......-......................%.......<.......V.......n................................................/......./......0/......9/......=/......P/......^/......y/......./......./......./......./......./......./..O..../..!....0......A0......J0......V0......k0..(...y0.......0.......0.......0.......0.......0.......0.......0.......1......!1......;1......N1.......1..c....1......^2......k2......v2......}2.......2.......2......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\az_AZ\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 771 messages, Project-Id-Version: electrum '(FX m\311\231z\311\231nn\311\231si \311\231l\303\247atmazd\304\261r)'
                                        Category:dropped
                                        Size (bytes):58340
                                        Entropy (8bit):5.4378098300492415
                                        Encrypted:false
                                        SSDEEP:1536:M0/NXoHgDJy7q3NtxmDTceC9Imp+JEsrOZYnDNr:M0doHgDJSYZmDTdC/yEZYDNr
                                        MD5:C2284BED2C683C241418DE2E9BAC03DC
                                        SHA1:AB19748E45F2F7F5C8A39578357577F34438D6F4
                                        SHA-256:73B02DF1ACB80E019790D0EEF7810824D12D1A94126F98964FBB9B5BE8AFEB1A
                                        SHA-512:FED3B40C623416342F65D0BBB98056E7903FE835C3192744B2CDD795B279FE0AC20929D5A021DF9012D0B3E66B8FE951D8C1935F962C52CF5C1DB000D8537243
                                        Malicious:false
                                        Preview:................4.......L0......h@......i@.......@.......@.......@.......@.......@.......@.......@.......@.......@.......A.......A.......A......&A......4A......?A......JA......_A......eA......mA......zA.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......B.......B.......B.......B......7B......>B......DB......LB......]B......cB......jB......qB..K...|B..m....B..#...6C..N...ZC..=....C..)....C.......D...... D..0...?D..4...pD..>....D.......D.......D.......E.......E......4E......@E......RE..'...bE..&....E.......E.."....E.......E..-....E......!F......)F......9F......KF......bF......pF.......F.......F.......F.......F.......F.. ....G......1G......;G......PG......eG......nG......rG......}G..0....G.......G.......G.......G..K....G......9H......TH..)...[H.......H.......H.......H.......H.......H.......H.......H..,....I......>I......LI......WI......]I..O...dI..2....I..!....I.......J.......J......&J......2J......GJ......\J..(...jJ.......J.......J..2....J......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\be_BY\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 92 messages, Project-Id-Version: electrum ' (\320\232\321\203\321\200\321\201\321\213 \320\262\320\260\320\273\321\216\321\202 \320\275\320\265\320\264\320\260\321\201\321\202\321\203\320\277\320\275\321\213\321\217)'
                                        Category:dropped
                                        Size (bytes):7945
                                        Entropy (8bit):5.513105300628986
                                        Encrypted:false
                                        SSDEEP:192:RU02G8iwCW/+lYnqnfPshcrkvk3n1z8/kp5:RUnValoBZcZBp5
                                        MD5:D802FD82602489E60AE6240A683B2F5F
                                        SHA1:39A5802D94B574CA55162A2B267370CF17859D97
                                        SHA-256:994ABEF1A0C908AB485F5B70C9E47A4322C5BB8FCA9DEF164BDD399C9CD26C73
                                        SHA-512:C8F3A78CC7316B4FA570BAF96BCF629F7EC54033566850AD491F0B7A71F740E62E58F5F57D3FCF4B0434741586ADC53E693437E12E0397DC55EFDF60048F6D08
                                        Malicious:false
                                        Preview:........\.......................................................................!.......4.......;.......J.......\.......u.......}...............................................................................................................,.......2.......<.......I.......O.......X.......f.......l.......{...........................................................................................................K.......m...P...#.......=.......)... .......J.......Y.......x...................................'...............-...........>.......F.......V.......h...................................................7...................(.......B.......M.......d.......n...............................................................6...!...T... ...v...........................0...]...................................;...................*...D...D...I.......................................................!...0.......R.......b.......p...........(...............".......!..................."...&...0.......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\bg_BG\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 492 messages, Project-Id-Version: electrum ' (\320\235\321\217\320\274\320\260 \320\275\320\260\320\273\320\270\321\207\320\265\320\275 \320\272\321\203\321\200\321\201 \320\267\320\260 \320\276\320\261\320\274\321\217\320\275\320\260)'
                                        Category:dropped
                                        Size (bytes):42246
                                        Entropy (8bit):5.368441980539918
                                        Encrypted:false
                                        SSDEEP:768:yF/P3MQQf+n89A7JNVw+slsjkmHy+i5+t4x4xi456m:i/z/173Vw+slsjkmS+vtNx55N
                                        MD5:00B223778C69AB4FC048BB5FD43B3F82
                                        SHA1:2F2AFAEC284A81DAA6969649E95E64D05DFA5801
                                        SHA-256:C3BF310DFEF83A751EBEB27BE91614D949F519E05C7681C38C313D1B6291E72B
                                        SHA-512:53154EA31A6C90F63E13C59D6157F4C9D83D879160C7DEB2E13AE6924E50E5BD387E4DE19093D5ADCF2E3ADEC2925437A4F458FA4B899A55DCF40BE0B5152BC6
                                        Malicious:false
                                        Preview:................|...............()......))......B)......P)......W)......b)......q).......).......).......).......).......).......).......).......).......).......).......*.......*......%*......-*......:*......B*......T*......]*......j*......w*......~*.......*.......*.......*.......*.......*.......*.......*.......*.......*.......*.......*.......*.......+.......+......#+......*+......0+......8+......I+......W+......g+......m+......t+......{+..=....+..)....+.......+.......+.......,..0....,.......,.......,.......,.......,.......-.......-......&-......:-......R-......j-.......-.......-.......-.......-.......-.......-....................................../.......<.......N.......`.......f.......m.......v...2..................................................../......./......./......+/......./......./..c..../......A0......L0......S0......]0......y0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......1../....1......O1..!...]1.......1.......1.......1.......1.......1......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\bn_BD\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: electrum
                                        Category:dropped
                                        Size (bytes):592
                                        Entropy (8bit):5.281270234681264
                                        Encrypted:false
                                        SSDEEP:12:i4SxjCt0d+j/4GoMXmBQWivXmBQWii3bb43ZPqzJkTj8bpX:RojCt0d+7CMXmQXmHn699jA5
                                        MD5:AF41EA96475D4C651C984F0FAA00EACE
                                        SHA1:7FDAFF4F0224415031CC727383013F853052E4F3
                                        SHA-256:A4263EEDEC96E890B96B05E53AD3493FEED367BE5A2354AA5D8D498225F36AFC
                                        SHA-512:645A9EF2C05571B691BE5E1C39BBC7B9CA6C557C027EB47483075F7FAF832D97C94CA829A577DBF3A4EAFE8245B8B478CF42522BCF9DFDF2CDA2D296EE2CCA6A
                                        Malicious:false
                                        Preview:................$.......,.......8.......9................Project-Id-Version: electrum.Report-Msgid-Bugs-To: .PO-Revision-Date: 2024-05-29 13:38.Last-Translator: .Language-Team: Bengali.Language: bn_BD.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Qt-Contexts: true.Plural-Forms: nplurals=2; plural=(n != 1);.X-Crowdin-Project: electrum.X-Crowdin-Project-ID: 20482.X-Crowdin-Language: bn.X-Crowdin-File: /electrum-client/messages.pot.X-Crowdin-File-ID: 68..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\cs_CZ\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 2246 messages, Project-Id-Version: electrum ' (\305\275\303\241dn\303\275 kurz k dispozici)'
                                        Category:dropped
                                        Size (bytes):206582
                                        Entropy (8bit):5.511387090624787
                                        Encrypted:false
                                        SSDEEP:3072:gl9ksbpAWHqCdhAmVw+slsiAiWrHoJ3muV2YE+wPuCTkIkwtR5NShwkyOm:gQXWHqehKQpGSkaShwnx
                                        MD5:D0822D2A2138562B216114A34F83CDBF
                                        SHA1:7CA24F6CCF2284EDAA645499ADC212E0B582BCAE
                                        SHA-256:EF68048E3FA875FA9F360BCE9AB0EF8AA468146E27BBFC83561B6D52A5C4EBE4
                                        SHA-512:411B230BC56F7C60C2916212F6B58B902214EAA64364784538699961D301D59D9A40A3797ED77F29574DC25F39D2C46BE63BC561203B621B3AC250607B669A65
                                        Malicious:false
                                        Preview:................LF......|.......X.......Y.......r.....................................................................................................$......./.......:.......O.......U.......].......j.......r..........................................................................................................................(...............C.......L.......S.......Z.......`.......h.......y........... ...............$......%..................(...............5...;...<.......x...K.......0......m.......#...n...........N...c...=.......)...................)...0...H...4...y...............Q...........L...]...>.......................0...........B.......R.......a.......t...................................................'.......,.......'...D...&...l...+.......*.......................3.......1...A..."...s...........-.................................................../.......=.......W.......s...................M...................%.......<.......\.......{...............................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\da_DK\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 362 messages, Project-Id-Version: electrum ' bekr\303\246ftelse'
                                        Category:dropped
                                        Size (bytes):24068
                                        Entropy (8bit):5.123170147625518
                                        Encrypted:false
                                        SSDEEP:384:aVOlbBh8d8kWA2tundlSum81W/S+TuRqLpoHKUBQpW8jD6:aYlbrGP73mtK+VWHT+D6
                                        MD5:6F58DFEC7DA500FDEC1F76327830E6DF
                                        SHA1:5E01F279C6EAA58D630020CFD5044ACD1908D1A2
                                        SHA-256:CA01E7A1404E6D6C7B676E978C03B606578566D5158EB3BC05275B10262F896D
                                        SHA-512:0448ADA8C149F180E73D5B8F1501588F9338F7DC57AF12F951A7EA7F3335E5F183C6698EFD914EF09C6216D343BD912AD812FD6207C31C1931E3508FA3860F5A
                                        Malicious:false
                                        Preview:........j.......l...............X.......Y.......g.......n.......y.......................................................................................................(.......0.......B.......K.......X.......j.......p.......z................................................................................................................ ....... ....... ..).... ......C ....... ....... ....... .......!.......!.......!....../!......G!......^!......z!.......!.......!.......!.......!.......!.......!.......!......."......."......."......%"......,"......4"......L"......V"......p"..c....".......".......".......#.......#.......#.......#..O...-#......}#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$......+$......2$......7$......<$......E$......M$......U$......\$../...h$.......$.......$.......$..f....$......-%..G...=%..1....%..-....%..4....%..4....&..K...O&.......&.......&.......&.......&.......&.......&.......&.......'.......'...... '......7'......?'......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\de_DE\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 2440 messages, Project-Id-Version: electrum ' (Wechselkurs nicht verf\303\274gbar)'
                                        Category:dropped
                                        Size (bytes):245641
                                        Entropy (8bit):5.291673542604029
                                        Encrypted:false
                                        SSDEEP:3072:ChHmTj/tGcHVw+slsuTiMhsvFvlTK7gMV2YE+/28ULUC+kA+QNK/ABZwV/hDuhrt:ChGf/sOTdI2GFkuK/oyShbQHyN
                                        MD5:6482EF5714F22B88ED804F91863F77DC
                                        SHA1:5E255CED57F87FC97F1038B8CDF0DAC94BFAF5C3
                                        SHA-256:6CAADD4CFBF323E4E4C9E4D2EC150F15282D0BA221C132204C561F94E78FA4B1
                                        SHA-512:C7A41C9CE9F8792124CC5D8C43BFDD89446E2677DA47A2D7443645DCA7AE0270A0AEB7116178AD40703983135D59F7540E84FE4F2F2D9DEECE65D91FA82B8955
                                        Malicious:false
                                        Preview:................\L..............p.......q...............................................................................................................<.......G.......R.......g.......m.......u...............................................................................................................................'.......3.......@.......F.......[.......d.......k.......r.......x........................... ...............$.......%...........1.......@.......F.......M.......T...K..._...0.......m.......#...J.......n...N...?...=.......).......................0...$...4...U...............-...........L...9...>.......................0...........................=.......P.......h.......|...................................'.......,.......'... ...&...H...+...o...*.......................3.......1......."...O.......r...-...................................................................3.......O.......c.......{...M...................................8.......W.......n...............................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\el_GR\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 283 messages, Project-Id-Version: electrum '&\316\240\316\265\317\201\316\257'
                                        Category:dropped
                                        Size (bytes):26844
                                        Entropy (8bit):5.416977634408204
                                        Encrypted:false
                                        SSDEEP:768:nzQwR9S0umfc+bkDaC5eEdw2rOnTodqiaTN1/y:7S0um0+I2C5eEOyOnTodqDTN1/y
                                        MD5:72AED5ADB5BE81C827BE0C57DF9234E7
                                        SHA1:17F7403EEFDC5AC07AEE4165E9C6E9702A159921
                                        SHA-256:A4F1C207B5C7F2EB130CFE42B8765E7C0DD58C933C572A4EF355B8465A0B4DE5
                                        SHA-512:365353D262181C0C4DE193F1829EB84E00206600F83B68F0DBDE2F281BB2725F3C5E0B96D70AFF428A9C34C921D750FF10375425F7896092EE814A5F0BCB294D
                                        Malicious:false
                                        Preview:....................{.........................................................................................../.......5.......=.......E.......W.......`.......m...........................................................................................................................)...........4.......................................................7.......R.......Y.......j.......w...................................c...........7.......B.......L.......].......a...O...h.................................................................................../...........I.......Q.......b...f...w...G.......1...&...-...X...4.......4...........................................).......<.......B.......Y.......p.......x...........................@...........................................!.......(.......-.......F...`...N...................!.......!.......R.... ......a ......m ....... ....... ....... ....... ....... ....... ....... .......!.......!....../!......8!..3...I!......}!.......!.......!......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\eo_UY\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 60 messages, Project-Id-Version: electrum '&Pri'
                                        Category:dropped
                                        Size (bytes):3829
                                        Entropy (8bit):5.050493676947178
                                        Encrypted:false
                                        SSDEEP:48:fyZTUdhzeww6wfHeEdb/C59pZwsNKvIpUIsKebV6epBjPd+Rvxa9djQfq+8x2NE+:fSYLzGeEK9Tw5vms+erLYtxAJT2N3+WF
                                        MD5:7A3B817DD4059ED942F2E6CD7BC14A7D
                                        SHA1:29743DB8B3829698A61A8AF1BD957F3A35B3EFAC
                                        SHA-256:A49DB02C6D4095191B9E51A79A13196C5D018BCE0F992C63355EA50867D9FDC8
                                        SHA-512:575096927022375D867B190E7B57560E5B7B52415BD11B4BEBB2A340C00A0B7F71EAF1B8139D464339E9CE5CE6786DCD8B787D2D44739336CA2C7E05D41A4174
                                        Malicious:false
                                        Preview:........<...........S...........(.......).......0.......?.......E.......K.......Q.......X......._............................... .......7.......>.......F...c...^.................................................................../...........7.......?.......G......._.......i.......o..................................................."...........:.......Q.......k...............................................................6.......T... ...g...............................................................................4.......9.......F.......O.......V.......].......d.......n....................................... .......%.......-...h...5...................................................................&...................................%...............4.......:.......?.......F.......P.......W.......\.......a.......k.......q.......v.......|...................................................................................................................................................4...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\es_ES\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1696 messages, Project-Id-Version: electrum ' (No hay tasa de cambio disponible)'
                                        Category:dropped
                                        Size (bytes):159552
                                        Entropy (8bit):5.181391923509779
                                        Encrypted:false
                                        SSDEEP:3072:1QGBGaN5+MVw+slsxbAx/d9JbhaE+fqJ/o1ExHFTIFIfweNt:1EaLIriQ/eaFUFITNt
                                        MD5:1BBE0A110E7B3B1F535062204835E6C3
                                        SHA1:3C1C7A66C2FE36CD5C4F2DB67FC51FB6576DABF1
                                        SHA-256:EE02D75E3CE4E737532D2519394795B4946820CB980D902AE48A0E5C67F50C62
                                        SHA-512:FC268322E33D4CEEB4C80A8BCE617BFFDBBE963FDE76B34F6EFB8F7AA86FBBCD43E1814A8F862A9A2A191089F56B2FB20BFC319C80E8AE1C501B252F7C2F25C5
                                        Malicious:false
                                        Preview:.................5.......j..........................................................................................%.......-.......3.......F.......T......._.......j...........................................................................................................................#.......).......8.......D.......Q.......W.......l.......u.......|...........................................................K.......0.......m...>...#..............N.......=......)...........X.......g...0.......4..............................L.......>..........'.......=...0...O................................................................'.......&.../...+...V...*.......................3......"...........'...-...7.......e.......m.......}............................................................./.......O.......n......................................... ...........1.......;.......P.......a.......s...................R..............."...................*.......4...7...G...O...........

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\fa_IR\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 356 messages, Project-Id-Version: electrum '\331\205\330\252\331\206'
                                        Category:dropped
                                        Size (bytes):32361
                                        Entropy (8bit):5.452367310516809
                                        Encrypted:false
                                        SSDEEP:384:s9buWXsKTlUPOlkTeV/aMW/7Ngb5Dn+LCBC/3oOIUo/iRVrXT1KYflepCC66MW54:QbLsPGlidZgbJnHC/YIMYfUpOL1/KCd
                                        MD5:84DF714F097778B80603118AFD92F633
                                        SHA1:0ABB264116F103FA327086700541F2CBA6890606
                                        SHA-256:DC4137658BF566AE88FAE134796E079633C905F34B1DC6594DDFC01BE31F8802
                                        SHA-512:300F6FB87EB34D9A3B1A2F92ECE04BA3996F38D47C23B7EF02571F0234A71F1F34B253DDB7398D15ACBCBA96DECA84CDF039E4370D17A0089A6B2C87E8A0D9AB
                                        Malicious:false
                                        Preview:........d.......<.......\.......................................................%.......,.......;.......M.......f.......n.......t.......................................................................................................................'.......-.......6.......D.......J.......Y.......e.......r.......x...................................................................................K.......m.... ..#.... ..=.... ..).... ......(!......7!..0...V!.......!......*"......."..0....".......".......#..'....#......@#..-...P#......~#.......#.......#.......#.......#.......#.......#.......$......&$......0$......E$......N$......R$..7...e$..O....$.......$.......$.......%..)....%......G%......c%......t%.......%.......%.......%..;....%..,....&......-&......;&......A&..O...H&..o....&..2....'..!...;'..K...]'..1....'.......'.......'..9....'..8...2(......k(......w(.......(..(....(.......(.......(..`....(..b...>)..2....).......).......).......).......).......*......#*......**......4*......N*......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\fr_FR\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1477 messages, Project-Id-Version: electrum ' (Aucun taux FX disponible)'
                                        Category:dropped
                                        Size (bytes):141467
                                        Entropy (8bit):5.2063635348502
                                        Encrypted:false
                                        SSDEEP:3072:oqT+SQiEN9Vw+slsRyAY042E+LO5CkeIyhhK5gQQ0Prk49+MTtITk2dUj3Frj:oKSr3vGleIyhhK5gQQ0ghMTtITk2dO3R
                                        MD5:D221DA3352EF268F7549FFACCA638E51
                                        SHA1:41B31D73EC65D89F817658C6F5A9EF799FD65FBD
                                        SHA-256:9A511D167739C42C7377E0ED5B8E7B28B2BF39BB41FB297EDD726854B7505628
                                        SHA-512:FCA7FAE172CCAF3ECE4EBD888EEA8F46B3C9840F0D5D040B81C56F8D1854892E253DFF1D012EACE5B6EE215BD76B80AEAD9649B1932B2EBDB17DC6100B9A718F
                                        Malicious:false
                                        Preview:................D.......l\......@{......A{......Z{......h{......o{......z{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......|.......|......"|......7|......=|......E|......R|......Z|......l|......u|.......|.......|.......|.......|.......|.......|.......|.......|.......|.......|.......|.......|.......}.......}......$}......-}......4}......;}......A}......I}......Z}......`}......g}......n}..K...y}..0....}..m....}..#...d~.......~..N...Y...=.......).......................0...>...4...o...............G..........>...S...................0..........................................5.......D.......P...'...b...,.......&.......+......*...........5.......D...3...X..."...............-..................................................<.......V.......j.............................................................5.......Q.......m..........................................................R...........Q..."...U.......x...........0......................7......O...........

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\he_IL\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1278 messages, Project-Id-Version: electrum '(\327\251\327\242\327\250 \327\224\327\236\327\250\327\224 \327\234\327\220 \327\226\327\236\327\231\327\237)'
                                        Category:dropped
                                        Size (bytes):129718
                                        Entropy (8bit):5.302530802003399
                                        Encrypted:false
                                        SSDEEP:3072:LzVCwr63GY/6Vw+slsbk4BLffJGk6EljuvqjVSgiIJH1coGUSKs:LxCGLB/SvqjVSgiIJH1coGUSKs
                                        MD5:F426144F3140FF0891A6CB259DC0C04D
                                        SHA1:B14E12AFF5FFC3E4F9F096DD03602C54B11D6548
                                        SHA-256:CDC2266B6E2205792C402118B14F20B592ECD6FE1259DA81826F74A79797F495
                                        SHA-512:357B5DEF996409119409E451FE6E8C9EC852FEADD8E649936D53ADA64FA17876CC4FB0FB59DAB9CCAAB3EB6E56FE4E7B5CE25DD10ABE8BEC6F5AB99A30394849
                                        Malicious:false
                                        Preview:.................(.......O.......j.......j.......j.......j.......j.......j.......j.......k.......k......7k......?k......Ek......Sk......^k......ik......~k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......l.......l.......l......*l......6l......Cl......Il......^l......gl......nl......ul......{l.......l.......l.......l.......l..=....l..)....l.......m.......m..0...8m..4...im.......m......An.......n......Mo..0...co.......o.......o.......o..'....o.......o..-....o......(p......0p......@p......Rp......ip.......p.......p.......p.......p.......p.......q.......q......7q......Sq......oq.......q.......q.......q.......q.......q..R....q......-r......1r..7...Dr..O...|r.......r.......r.......r..)....r......&s......Bs......Ss......`s......rs.......s..;....s..,....s.......t.......t...... t..O...'t..o...wt..2....t..!....u..K...<u..1....u.......u.......u..9....u..8....v......Jv......Vv......kv..(...yv.......v.......v..`....v..b....w..2....w..0....w......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\hu_HU\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 2437 messages, Project-Id-Version: electrum ' (ismeretlen \303\241rfolyam)'
                                        Category:dropped
                                        Size (bytes):246841
                                        Entropy (8bit):5.44158151251534
                                        Encrypted:false
                                        SSDEEP:3072:/qwjl1JhdB9vdwv7tGcHVw+slsuTiMasvFvlTK7gMV2YE+/28ULUC+kA+Q4Exavn:/qwjphdBJdQsOadI2GFkxEipwRI
                                        MD5:FD7AD09DCB5122A07279390F0D5AD68C
                                        SHA1:B51F5F4A75E550E990111C6187FE33CAC724C603
                                        SHA-256:937DDA85E3B8C9FFA69E39822EFB146626F3F7BFFF751632F2DF9FE261C3BB2E
                                        SHA-512:A3DAABD56B23D3BF3E705F3CC52594BAAF046A3EDC58148377D3DCC92F68605D089F8691D62A85AA5870A40520AE053CC64C2B0A07641CA71F6D42E03BD2DD43
                                        Malicious:false
                                        Preview:................DL......l.......8.......9.......R.......`.......g.......r......................................................................................................./.......5.......=.......J.......R.......d.......m.......z.......................................................................................................................#.......,.......3.......:.......@.......H.......Y.......g... ...w...........$.......%...............................................K...'...0...s...m.......#...........6...N.......=...V...).......................0.......4...........R...............~...L.......>...N...................0...........................................0.......D.......V.......e.......q...........'.......,.......'.......&.......+...7...*...c...................3.......1......."...........:...-...J.......x.......................................................................+.......C...M...c...............................................6.......L.......h...............

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\hy_AM\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 267 messages, Project-Id-Version: electrum '&\325\204\325\241\325\275\325\253\325\266'
                                        Category:dropped
                                        Size (bytes):17891
                                        Entropy (8bit):5.359619489859007
                                        Encrypted:false
                                        SSDEEP:192:nPJ4gzC+TYMptKHeYpgPuGsYCMXrm976D459sxswzJZu6I3YqCP8BmXq8oze+hg:nPJLkh+YqPuww9m1mwjMfCEBzeQg
                                        MD5:823ED8CB1EF76B5F7B9A9449B9A9878D
                                        SHA1:C993359901DB6F5826BC7602DF715CFE63354E48
                                        SHA-256:5BE972A5768E6AC24FF3BAF96F7E371A91A8FD5E689C6EF187A473F67B0C5499
                                        SHA-512:41B63C92CA46FE7E14491C9D19EE2F257CCCC67519D46BBFB795F9E23FFD9FFEA4086552C8F254D9003E1B2A9F016334A52BF9D63C24B6D9EB8874E3F0950A77
                                        Malicious:false
                                        Preview:................t...g...........h.......i.......p.......{.......................................................................................................$.......-.......:.......L.......R.......\.......i.......r...................................................................................................)...........................................................................!.......=.......X.......u.......|...................................................................................c...........................%.......A.......R.......[......._.......f.......w...........................F.......O...).......y.......................................................................................................;.......Y.......h.......z...............................................................................................................,.......7.......G.......Z.......`.......w.......................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\id_ID\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 911 messages, Project-Id-Version: electrum ' (Tidak ada FX rate yg tersedia)'
                                        Category:dropped
                                        Size (bytes):75661
                                        Entropy (8bit):5.1311943163205065
                                        Encrypted:false
                                        SSDEEP:1536:nCsfOMuzD/e14Z9XsVw+slsD4+RKBiiJF8KmeE+iBdeqdkJ2OEnZe4PoPa:MleQsVw+slss+RFiJFDE+iBoq0EZUa
                                        MD5:24781CA0E413CE5548C60E5FA503F8A2
                                        SHA1:B72E761B1823CD92890FABB4C84D853FEB167C8A
                                        SHA-256:2B7A94D4254A9475744D8B55B144352D6F4D2A19F634C7DB7AA674E18123FDFB
                                        SHA-512:5A10AAF6BFF7D0AFC48C4C97D07161FA980FD5212D49501FE15FCB88DAFDC4A2D7E8F71FFF36568EFC2CC3E3DC4B70CD4CED6DB9F2A42AC666BAB271450F13BB
                                        Malicious:false
                                        Preview:.........................9.......L.......L......*L......8L......?L......JL......YL......lL......sL.......L.......L.......L.......L.......L.......L.......L.......L.......L.......M.......M.......M......"M......*M......<M......EM......RM......dM......jM......tM.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......N.......N.......N......#N......*N......1N..K...<N..0....N..m....N..#...'O......KO..=....P..)...ZP.......P.......P..0....P..4....P.......Q.......Q......DR.......R.......R.......R.......R.......S.......S..'...,S..*...TS.......S..-....S.......S.......S.......S.......S.......S.......T......0T......HT......_T......uT.......T.......T.......T.......T.......U.......U...... U......1U..R...:U.......U.."....U.......U.......U..7....U..O....V......cV..K...qV.......V.......V..)....V.......W......%W......6W......CW......UW..'...dW.......W.......W..;....W..,....W......&X......4X......?X......EX..O...LX..o....X..2....Y..!...?Y..K...aY..1...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\it_IT\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1518 messages, Project-Id-Version: electrum ' (Nessun tasso FX disponibile)'
                                        Category:dropped
                                        Size (bytes):141299
                                        Entropy (8bit):5.153426464246187
                                        Encrypted:false
                                        SSDEEP:3072:ImNgF5MOxOC8Vw+slsxM4ZD0JsHJE+YEUCkqHZp8tHKsSx26EMfM3lj+:ImNgFBOJx29lqHZpaHOx28M3lj+
                                        MD5:A2E20A145C77D9B7F46978936FFEB057
                                        SHA1:940C9292626ABB3279FCB65D637D5521FF3D2D82
                                        SHA-256:3F40E5B7DA4AB37A3416120AAA11BFA4713BD33B4BD73685ADEDE186F1AAB45B
                                        SHA-512:3D23BB1A976CF75D677BDBB890EBBF21840C175E3186372DC8E775700E801DB368AB81576398DD6F1132EB347E405DFEACBA26A5A6B6A13D0109EA2522391208
                                        Malicious:false
                                        Preview:................./.......^.......~.......~.......~.......~.......~.......~.......~..............................,.......E.......M.......S.......f.......t....................................................................................................................... .......&......./.......=.......C.......R.......^.......k.......q..................................................................$.......................................K...$...0...p...m.......#...........3...N.......=...S...)......................0......4...........O..............{...................0...&.......W.......g.......v...........'.......*..............................-...........H.......P.......`.......r.....................................................!.......7.......S.......n.......................................................R...........d..."...h...........................7.......O..........D.......R.......m...)...t.................................'..................1...;...C...,...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\ja_JP\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1634 messages, Project-Id-Version: electrum ' \357\274\210\346\263\225\345\256\232\351\200\232\350\262\250\343\203\254\343\203\274\343\203\210\345\210\251\347\224\250\344\270\215\345\217\257\357\274\211'
                                        Category:dropped
                                        Size (bytes):176923
                                        Entropy (8bit):5.9253117816293015
                                        Encrypted:false
                                        SSDEEP:3072:aXgzctoePNMjYy6iT8Vw+slssX4YohlJs+HE+27qCx5kdVoXFz+YL6CVI2VkW:7zcoKNkYcIXqW45yol/VVVB
                                        MD5:024242E28294EDB37790E74AA962F511
                                        SHA1:1C26EDB0D81DB5C1F4FE9D3894209A9F75ED2107
                                        SHA-256:72DD9C12AF601E83D9EAAD89D5D65263236801B7775F4FAE0494B008921DE4EB
                                        SHA-512:AE71DCE9E5B2548DA6006C29308988C90A2284696647927E4819CEE36E662203CD606070010B97743C73E6DBACFFD21533A6DC09F1C48F223F98740131144542
                                        Malicious:false
                                        Preview:........b.......,3......<f......H.......I.......b.......p.......w...................................................................................................*.......?.......E.......M.......Z.......b.......t.......}...................................................................................................................(......./.......6.......<.......D.......U.......[.......b.......i...K...t...0.......m......#..._...........=...T...)......................0......4...........P..............|...................0...'.......X.......h.......w...........'.......*..............-...........&...............>.......P.......g.............................................................1.......L.......h.................................................R..........B..."...F.......i.......}...7.......O..............K...&.......r...........).............................................'...........A.......`...;...r...,.....................................O.......o...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\ko_KR\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 867 messages, Project-Id-Version: electrum '\355\231\230\354\234\250 \353\241\234\353\224\251 \354\213\244\355\214\250'
                                        Category:dropped
                                        Size (bytes):75023
                                        Entropy (8bit):5.901271857703765
                                        Encrypted:false
                                        SSDEEP:1536:Jc/RGw2g92W1Ja60lsw2cqnVx2mTE+e7q8JmoZWF4W4QYJbzAwm:aRv9px0lsjxZE+e71e8b0
                                        MD5:899DEC32465CAC98DEF58553834D90F9
                                        SHA1:473A96E570298820E6D2E735820CAB4F8DBBA924
                                        SHA-256:7A550F47402D2331CEC681096DEF7EB4991348B88776E4B8E87158ED921DF5CE
                                        SHA-512:0ED88F1140591C483B268A961C0BCE581C76C6E310A12F5C75F267B6848BB8BD12E29EF60BD79BE06FD4D4AD36E972C553208732981DD84142376A045E6D365F
                                        Malicious:false
                                        Preview:........c.......4.......L6......xH......yH.......H.......H.......H.......H.......H.......H.......H.......H.......H.......I.......I......#I......6I......DI......OI......ZI......oI......uI......}I.......I.......I.......I.......I.......I.......I.......I.......I.......I.......I.......I.......J.......J.......J...... J....../J......;J......HJ......NJ......cJ......lJ......sJ......zJ.......J.......J.. ....J.......J..$....J..%....J.......K......*K......0K......7K......>K..K...IK..0....K..m....K..#...4L......XL..N...)M..=...xM..)....M.......M.......M..0....N..4...?N......tN.......O.......O......#P......9P......HP......TP......fP..'...vP..,....P..'....R..&....R..+....S..*...FS......qS.......S..3....S.."....S.......S..-....S......)T......1T......AT......ST......jT......xT.......T.......T.......T.......T.......T.......U......0U......MU......WU......lU......}U.......U.......U..R....V.......V.."....V...... W......+W..0...5W......fW......zW..7....W..O....W..2....X......HX..K...VX.......X.......X..)...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\ky_KG\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 146 messages, Project-Id-Version: electrum 'Electrum &\321\202\321\203\321\203\321\200\320\260\320\273\321\203\321\203'
                                        Category:dropped
                                        Size (bytes):8631
                                        Entropy (8bit):5.4026184165113325
                                        Encrypted:false
                                        SSDEEP:192:IHpljx5rtqkI8OHDLsxsAdzaP6y6YjSmQXXJE:IHpSr38mAduKySa
                                        MD5:FD4E26CD008062111CF392271CBC163F
                                        SHA1:AF3963C8D5ECB183CE6D85467B9B6AE27F7821E9
                                        SHA-256:45186F9740141BF08B5DE60E68CEA2A14550D0E17718F8DFD97B001E2F2B0315
                                        SHA-512:AFB7E3BC32FE52A06DC322399900B5BA79DAE906FA89D763D3C3AA2446291412C9A03121923AA64CA68BE87330D750374D9D1405764F1FBC5B5A7F0A219AE4A8
                                        Malicious:false
                                        Preview:........................<.......P.......Q.......X.......g.......o.......u...............................................................................................................................................0.......H......._.......{.......................................................................................................................-.......2.......9.......E.......T.......Z.......q...........................................!.......!...........................).......@.......[.......o..........................."................................... .......7.......?.......X.......p...............................................................................&.......2.......H.......a.......m.......................................................................7.......>.......M.......j...........................................................................)...........<.......Q.......k.......t... ...~... ...........................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\lv_LV\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1215 messages, Project-Id-Version: electrum ' (val\305\253tas kurss nav pieejams)'
                                        Category:dropped
                                        Size (bytes):101644
                                        Entropy (8bit):5.348761988834637
                                        Encrypted:false
                                        SSDEEP:3072:FleSJ5oj+2GN4PVE+MjA6uhB2n0SrJ/IcH3vb:3jFZBjA6uhQnTlV3T
                                        MD5:AF4E0692C53045AFAFE1A35DF9650156
                                        SHA1:2EC5DB769D808ACB5CB0F31DA2329FBF11576BA6
                                        SHA-256:D72B733DA0170875CCE585C1D319B76558D514762ABB761C82A12F92080498E5
                                        SHA-512:CD4D20532AAB85EC428D78C3126354C2F0D55550065EE58381FA4C0648D630C2610A684A1DE388FFF7E1A458E2DBAA8269EFAE2C9A7ACF5BD5D0B967E7724832
                                        Malicious:false
                                        Preview:.................&..U....L......`e......ae......ze.......e.......e.......e.......e.......e.......e.......e.......e.......e.......f.......f.......f......$f....../f......Df......Jf......Rf......_f......gf......yf.......f.......f.......f.......f.......f.......f.......f.......f.......f.......f.......f.......f.......g.......g.......g......1g......:g......Ag......Hg......Ng......Vg......\g......cg......jg..N...ug..)....g.......g.......g.......h..0....h.......h.......h.......h..'....h..*...&i......Qi......`i......ti..-....i.......i.......i.......i.......i.......i.......j......#j......:j......Zj......qj.......j.......j.......j.......j.......j.......k.......k......2k......Dk......Xk......ak......ek......yk..7....k..O....k.......l.......l......7l......Hl......Ul......gl..'...vl.......l.......l.......l.......l.......l..o....l..K..._m..1....m.......m.......m..9....m..8...4n..(...mn.......n..`....n..b....o......eo......to.......o.......o.......o.......o.......o.......o.......o.......o.......p......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\nb_NO\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 527 messages, Project-Id-Version: electrum '%d bekreftelse'
                                        Category:dropped
                                        Size (bytes):38324
                                        Entropy (8bit):5.121849184747568
                                        Encrypted:false
                                        SSDEEP:768:qytoF/bPv+xN0Vw+sls21VAmb5++q6wuXEjI0OBnRwcEAHRJNob:MF/bP2xN0Vw+sls21VAmt+X3RAHRwb
                                        MD5:1B6F1AA21E121DA0256F56747C6F5653
                                        SHA1:5C55BD56D5CD4CFD7040F46FEA52C47390DA52AE
                                        SHA-256:92AA6465F6BCA3E0BA889D7B1B83D19E6E0FD426A3BB9BC733DEB195556AE79A
                                        SHA-512:0C40B89A270EE9594AC92505D01FC3B50424DC04769FBDE7AD516B0BEEDF05CA58AEECC22ABE615479AF4AB82DA110DAFFE5C5C36E30DD747EE9228939064EFB
                                        Malicious:false
                                        Preview:.........................!...... ,......!,....../,......6,......E,......^,......f,......l,......z,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......-.......-.......-......)-....../-......;-......A-......V-......]-......d-......l-......r-......y-.......-..=....-..)....-.......-..0...........3..............._/......u/......./......./..-..../......./......./......./......./.......0......'0......?0......V0......r0.......0.......0.......0.......0.......0.......0.......0..K....1......Q1......l1..)...s1.......1.......1..'....1.......1.......2..;....2..,...P2......}2.......2.......2.......2..O....2..o....2..2...c3..!....3..K....3..1....4......64......?4..9...S4..8....4.......4.......4.......4..(....4.......5......-5..`...85..b....5.......5.......6......%6......16......>6......K6......P6......a6......w6.......6.......6.......6.......6.......6.......6.......6.......7.......7.......7.......7.......7.......7..c....7......K8......X8......c8......n8......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\nl_NL\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 2430 messages, Project-Id-Version: electrum ' (Geen FX-tarief beschikbaar)'
                                        Category:dropped
                                        Size (bytes):234575
                                        Entropy (8bit):5.199330625751406
                                        Encrypted:false
                                        SSDEEP:3072:CI9dUgY6tlcVGcHVw+slsubDMHsvFvGTK7gMV2YE+N28ULUC+kA+QK0jycOmaX3Q:bfLtSEP/oU2GFk1Uy0ano6yCm
                                        MD5:8314726B9C001EC0724E6890604EAD0A
                                        SHA1:434806DB9C7BD5100ADC7C3E9AAC8AB134FC377B
                                        SHA-256:C66670AEA6734CB78C87F1EF331E8FC74CE1498D15305D74CEA1874EF0B1510A
                                        SHA-512:79D57B13455F04AD566DBB6A85CC5B48020BDDF030F90C2C9E239692BD383194065000F9016F6081F738DE7C23437FD69ACE9868CCC795FEAA76FB1E916AE90C
                                        Malicious:false
                                        Preview:........~........L......................................................................$.......+.......:.......L.......e.......m.......s.......................................................................................................................0.......6.......@.......M.......S.......\.......j.......p................................................................................................... ...........(...$...>...%...c...........................................K.......0.......m...4...#...............N.......=.......)...$.......N.......]...0...|...4...............................L.......>...................3...0...E.......v...........................................................................'...#...,...K...'...x...&.......+.......*...................-...3...A...1...u..."...............-........................... .......2.......I.......c.......q...................................M...........A.......Y.......p.......................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\pl_PL\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 738 messages, Project-Id-Version: electrum ' (Kursy waluty niedost\304\231pne)'
                                        Category:dropped
                                        Size (bytes):58262
                                        Entropy (8bit):5.323465295409492
                                        Encrypted:false
                                        SSDEEP:1536:K/Rg/KLOL+Vw+slsDaWhZKmkE+pOqyfqUwvRDvQ:n6OSVw+sls2W6E+pOqoqUYDvQ
                                        MD5:6779F95AC63286787CAE9A70F6AFF9A1
                                        SHA1:92D6DD0102FDA7D04C3F999CA300B098848A2E5A
                                        SHA-256:767E40167F2D42FD788A6C5AFD7E2A40AFB4C2AF95B2F24625F49488DFBF0999
                                        SHA-512:D5DA017876619664DA829080EB1F9BF330CB4C4A3DEECEEAFAD8B34F81C2693CB1A8B31735D2A7E7FAD3C0A816D66B31A3CB6C2C6519E6850B4FF2C6C36AF462
                                        Malicious:false
                                        Preview:................,.......<........=.......=.......=.......=.......=.......=.......>.......>.......>......->......F>......N>......T>......b>......m>......x>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......?.......?.......?......$?......*?......9?......E?......R?......X?......m?......v?......}?.......?.......?.......?.......?.......?.......?.......?..K....?..m....@..#...|@..=....@..)....@.......A.......A......6A.......A......bB......xB..0....B.......B.......B.......B.......B..'....B...... C..-...0C......^C......fC......vC.......C.......C.......C.......C.......C.......D.......D......9D......VD......`D......uD.......D.......D.......D..7....D..O....D....../E......=E......XE..)..._E.......E.......E.......E.......E..;....E..,....F......4F......BF......HF..O...OF..o....F..2....G..!...BG..K...dG..1....G.......G.......G..9....G..8...9H......rH......~H.......H..(....H.......H.......H..`....H..b...EI.......I.......I.......I.......I.......I.......I......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\pt_BR\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 2257 messages, Project-Id-Version: electrum ' (Sem a taxa FX dispon\303\255vel)'
                                        Category:dropped
                                        Size (bytes):216445
                                        Entropy (8bit):5.257912655777451
                                        Encrypted:false
                                        SSDEEP:3072:xAoMUvjIlfATQ07bc6Vw+sls6ZAD5svJ9HKiV2YE+YvSCCKk4AQxCjMSbMW5JXlo:ZMHIbVSkvvHkxMssJb
                                        MD5:C0614F37AF1748C10319717E24399728
                                        SHA1:FE131240E84BDB77C0D312C6A01FAE3787FDE852
                                        SHA-256:BB055688994505A3C8F847E08F8744DAD7CEB3511A827942F1401C902DF04662
                                        SHA-512:52ABD58A62E1AF7273CB89F17A15C6F4F8A72EC5D042D3F94F9E8262F0407262F551B3E98C9E25FCBCE446B90400894EE6A4E9C3854FBB8759DACF9A6FC8B3DE
                                        Malicious:false
                                        Preview:.................F......,.......8.......9.......R.......`.......g.......r..................................................................................................../.......5.......=.......J.......R.......d.......m.......z..................................................................................................................#.......,.......3.......:.......@.......H.......Y... ...i...........$.......%.............................................K.......0...e...m.......#...........(...N.......=...H...).......................0.......4...........D...............p...>...........2...0...H.......y...........................................................'.......,...(...&...U...+...|...*.......................3......."...*.......M...-...].......................................................................*.......>.......V...M...v.......................................2.......I......._.......{...........................'............... .../.......P.......Z.......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\pt_PT\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 978 messages, Project-Id-Version: electrum ' (Sem a taxa FX dispon\303\255vel)'
                                        Category:dropped
                                        Size (bytes):74522
                                        Entropy (8bit):5.180723648720087
                                        Encrypted:false
                                        SSDEEP:1536:IRiZv013PB4rLdfmw+slspjB7AnwG2m+PXE+r0EtkkbGWbRr7rHG8S:I2/dOw+slsRB7z3E+r0EtIWdHrHZS
                                        MD5:5C6CB71E34A82965C2312A6DCF44864B
                                        SHA1:5B6CEBD1B344FED9B5AA206072FDF6A6A27C5D22
                                        SHA-256:F440E710F841264DCE5F9513853621389E1019EFB4DBADD98230C7B37F9B41A6
                                        SHA-512:CA078954301BF5270CF3C93C062A9CB314E80B311E88B701BD0BA97FE05CEA8EA3B63690D9A4FDD82F49BF272F8214ED5BCA7CFE049C1158F188A1F378DE7CC0
                                        Malicious:false
                                        Preview:........................<=.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......R.......R.......R......,R......ER......MR......SR......fR......tR.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......S.......S.......S......&S......,S......5S......CS......IS......XS......dS......qS......wS.......S.......S.......S.......S.......S.......S.......S.......S.......S.......S..K....S..0...-T..m...^T..#....T.......T..N....U..=....V..)...NV......xV.......V..0....V..4....V.......W.......W......8X.......X.......X..0....X.......Y......$Y......3Y......?Y..'...QY......yY..-....Y.......Y.......Y.......Y.......Y.......Y.......Z......*Z......BZ......YZ......oZ.......Z.......Z.......Z.......Z.......Z.......Z.......[..R....[......l[......p[..7....[..O....[.......\.......\......4\..)...;\......e\.......\.......\.......\.......\.......\.......\..;....\..,...-]......Z]......h]......s]......y]..O....]..o....]..2...@^..!...s^..K....^..1....^......._..9...._..8...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\ro_RO\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 482 messages, Project-Id-Version: electrum '(Nu este disponibila rata FX)'
                                        Category:dropped
                                        Size (bytes):38327
                                        Entropy (8bit):5.161015437615511
                                        Encrypted:false
                                        SSDEEP:768:pxqsV6JiI4DD92nk6KmWRE+AoQCT+cxsKuuwg7E1HcN5ir:zqsUJ8DB2nk6KmeE+A1CKcWKV5ir
                                        MD5:D12B71D6FCC559E90C4D9094C82000CC
                                        SHA1:A23BD3FEC73D2E73612C0D121A4B2B57A7E827C6
                                        SHA-256:70A55DF48932FDD8DF1D34CA83F4818DA51D7EC823338596FA66A844259C0006
                                        SHA-512:E3DC3BC241DD7A3B36A83B84863E4D2C4FFE31A2D0FEC0940CC4F56652C85B8A8A0BC2B04C94517DC7D1853C93B869B6E3567C03D00B5024E0949D461BAB873E
                                        Malicious:false
                                        Preview:................,.......<.......H(......I(......b(......p(......w(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......).......).......)......$)......1)......9)......K)......T)......a)......s)......y).......).......).......).......).......).......).......).......).......).......).......).......).......*.......*.......*.......*......,*......2*......9*......@*..K...K*..m....*..#....+..=...)+..)...g+.......+.......+..0....+.......+.......,.......-......2-......A-......M-..'..._-.......-..-....-.......-.......-.......-.......-..............$.......@.......[.......w...................................!.......1............/......(/......3/......8/......@/......X/......b/......|/.......0..c...(0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......1.......1....../1..F...^1..O....1.......1.......1.......2.......2.......2.......2......%2......92......K2......X2......m2.......2..=....3......N3......}3.......3.......3.......3.......3.......3......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\ru_RU\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1443 messages, Project-Id-Version: electrum ' (\320\232\321\203\321\200\321\201\321\213 \320\262\320\260\320\273\321\216\321\202 \320\275\320\265\320\264\320\276\321\201\321\202\321\203\320\277\320\275\321\213)'
                                        Category:dropped
                                        Size (bytes):168884
                                        Entropy (8bit):5.472677280462419
                                        Encrypted:false
                                        SSDEEP:3072:E9A/9IgZzctVw+slsR7oJkXJeNE+GQnCN5FgfAhikQRWYtoIi8KOZZtCwbEAApD:E9AtRZyvkG5efNkxc99KOZZUwbEAApD
                                        MD5:C8C83E0856A67E7C0FFFE84123700342
                                        SHA1:A7D4F1430FDCB365B2553DFDDF1E7C476911FE30
                                        SHA-256:E1D1D95D10ABE73EF8E40BD9A8712560E399F95FCD9EA3E6E5221E973AAEDE8E
                                        SHA-512:FE614BB12F73872FB4D5B958F47449AEC99EAE39A64703E777EAEEB65D34045DC3D0163EB25FD0C99A92356D9AAEA2DC7AEAA39B112440B260233DA614E8DB51
                                        Malicious:false
                                        Preview:................4-......LZ......xx......yx.......x.......x.......x.......x.......x.......x.......x.......x.......x.......y.......y......#y......6y......Dy......Oy......Zy......oy......uy......}y.......y.......y.......y.......y.......y.......y.......y.......y.......y.......y.......y.......z.......z.......z......(z......4z......Az......Gz......\z......ez......lz......sz......yz.......z..%....z.......z.......z.......z.......z..K....z..0...#{..m...T{..#....{.......{..N....|..=....}..)...D}......n}......}}..0....}..4....}.......~.......~..........................0...........................).......5...'...G...*...o..."...............-..................................%.......<.......J.......d.......|...................................................../.......K.......g........................................................"..............................7...2...O...j...........K................../...)...6.......`.......|..........................................;......,...(.......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\si_LK\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1600 messages, Project-Id-Version: electrum ' (FX \340\266\234\340\267\217\340\267\203\340\267\212\340\266\255\340\267\224\340\267\200\340\266\232\340\267\212 \340\266\261\340\267\234\340\266\270\340\267\220\340\266\255)'
                                        Category:dropped
                                        Size (bytes):235682
                                        Entropy (8bit):5.151796827691006
                                        Encrypted:false
                                        SSDEEP:3072:Vj7fQ1yAWhpuafz+ZVw+slsgMIP1sFJsZuE+27qCa5011zil6eTkdvq4g5Tpf/QR:VjUYIMXWkWb501NeTkdvq4ITJ/mN
                                        MD5:356236F5E0E9E01F253A2382C66CC71F
                                        SHA1:04950205832F22B13FEABAB3CC5B37D14ACCE174
                                        SHA-256:32BB5B9493099384A9A834B1679D55D026A4E4B77426AAAA73266E07F619FC98
                                        SHA-512:5DDF9DD88E61B47C2D7F07375C533CC62D0CC576E88B0BA8679226FC2C8FEA8F7AFFB4D94FD6E9603089D947F30EADABE91615EBD5771188809EDC8A29B3E09D
                                        Malicious:false
                                        Preview:........@........2..Y....d..................................................................................................%.......+.......>.......L.......W.......b.......w.......}..................................................................................................................#......./.......<.......B.......W.......`.......g.......m.......u...................................K.......0......m..."...#...............=.......).....................0.......4...L...............$...............0...0...F.......w...........................'.......*..............-...........E.......M.......].......o.............................................................4.......P.......k........................................................R...........a..."...e...................7.......O..........7...K...E...................)..........................................)...'...8.......`...........;.......,......................................O... ...o...p...2.......!...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\sk_SK\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1345 messages, Project-Id-Version: electrum ' (Nie je k dispoz\303\255cii v\303\275menn\303\275 kurz)'
                                        Category:dropped
                                        Size (bytes):126100
                                        Entropy (8bit):5.4305341815611845
                                        Encrypted:false
                                        SSDEEP:3072:fkCqQlm3HkoVw+sls6hoXAp8rTE+HEnCkBUjpsmiDxR:fkCqvhwcYlBysmidR
                                        MD5:F0E5C0AD99A4347A28A811F389E4D8EE
                                        SHA1:502B1CBD0BDDE6E973C9027E61E67CA3EB4A635A
                                        SHA-256:23D462599B5A38AE46E5B7F563B6F8A960CA5E9D51A910B67EB0BEC064D9D747
                                        SHA-512:7D42B583D0913D23822CE787F6BDF06125166E4B96202B8B6BD6B41528EE42B00027A3BA6FF25502776A8A06ED87AB7B4F817E6ACA6FB92BD76EAB46FCB82538
                                        Malicious:false
                                        Preview:........A.......$*......,T......Pp......Qp......jp......xp.......p.......p.......p.......p.......p.......p.......p.......p.......p.......q.......q.......q......-q......3q......;q......Hq......Pq......bq......kq......xq.......q.......q.......q.......q.......q.......q.......q.......q.......q.......q.......q.......q.......r.......r.......r......$r......*r......2r......Cr......Ir......Pr......Wr..K...br..m....r..#....s..=...@s..)...~s.......s.......s..0....s.......t.......t......3u..0...Iu......zu.......u.......u.......u..'....u.......u..-....u.......v......%v......5v......Gv......^v......vv.......v.......v.......v.......v.......v.......w.......w......Jw......gw......qw.......w.......w.......w.......w.......w..7....w..O....x......Tx......bx......}x..)....x.......x.......x.......x.......x.......x.......y..;...+y..,...gy.......y.......y.......y..O....y..o....y..2...oz..!....z..K....z..1....{......B{......K{..9..._{..8....{.......{.......{.......{..(....|......*|..`...5|..b....|.......|......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\sl_SI\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 69 messages, Project-Id-Version: electrum 'Dokumentacija'
                                        Category:dropped
                                        Size (bytes):4110
                                        Entropy (8bit):5.091230435692075
                                        Encrypted:false
                                        SSDEEP:96:oXfbsjjfq8bjVuJsxsPoXM6RALYyxLkQo6Le:oXzsj7/bjoJsxsPUM6REYLQFLe
                                        MD5:318F32FC5C900BFD8EF107B055FEC754
                                        SHA1:EE88F2B9A8397C94F69A6FC6297F2EC83D304577
                                        SHA-256:3BD5B4434DADE5D352C209D0D55FACE09B9F8BC1BACCA913E213F8FD6219FF75
                                        SHA-512:28EED0376FC0C096BCFC83ED241D997E4B8D122BAA29EF499C5DD2FA63379C01E9523ACB190525108D56FAE51FD4570ED4D2B552BDF51D26132AEFDD7CEFB832
                                        Malicious:false
                                        Preview:........E.......D...a...l...............................................................'.......?.......W.......^.......f.......~.......................................................................................".......9.......T.......h..."...............................................................u...).......................................................................'.......B.......W.......m.......u......................................................./...!...M.......o.......t... ...y... ...........................................................0.......E...J...Q.......................................................................................................................................................&.......0.......B.......T.......n.......u.......z...............................................................................................................................................$.......9.......N.......U.......[.......b.......i.......t.......{.......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\sr_CS\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: electrum
                                        Category:dropped
                                        Size (bytes):677
                                        Entropy (8bit):5.415029617033475
                                        Encrypted:false
                                        SSDEEP:12:i4VxjCt0d+j/41r7WXmBQWivXmBQWii3bbkHzkj7f3ZPqAmZkTj8bpX:RHjCt0d+7s7WXmQXmHn+gjj9pmUjA5
                                        MD5:99E5C5C001D85FBD14B63A56D4CE3D33
                                        SHA1:C76519A51CA6D2A7DEEE5608D994414E0B976BAE
                                        SHA-256:2F868826E8E58EA9F8A2C4C1DAEAE90CF920C8A38BD9F3113B05A5AB7621BA18
                                        SHA-512:7706549A3DE886393C56E125EEEFF3BD138950FFEED840B6FADBDAE27ACB3567E52C210C45958C95B7136FACD922294DACE489901BF52AC35828DBB3AE4E9804
                                        Malicious:false
                                        Preview:................$.......,.......8...k...9................Project-Id-Version: electrum.Report-Msgid-Bugs-To: .PO-Revision-Date: 2024-05-29 13:38.Last-Translator: .Language-Team: Serbian (Latin).Language: sr_CS.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Qt-Contexts: true.Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);.X-Crowdin-Project: electrum.X-Crowdin-Project-ID: 20482.X-Crowdin-Language: sr-CS.X-Crowdin-File: /electrum-client/messages.pot.X-Crowdin-File-ID: 68..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\sv_SE\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 682 messages, Project-Id-Version: electrum ' (Ingen v\303\244xlingskurs tillg\303\244nglig)'
                                        Category:dropped
                                        Size (bytes):44478
                                        Entropy (8bit):5.1883421537661745
                                        Encrypted:false
                                        SSDEEP:768:em7kAF/xS3RQPgrxvFCQDNSsFyq3JmxB5MDIvUA/1UJqC:5YCS3QK9FxNSsFyq3JmKA/1UJt
                                        MD5:19D9389118B4862F2BC6BE565BD6CB17
                                        SHA1:3FA7CE711F35F47D12D760AAB9E5332E7601CBF0
                                        SHA-256:8B591DB3DF6D8D912C87276E2C4CCA0101354E6DC02F3E3BC95694C3AC26D935
                                        SHA-512:FB934799F36B78C214A0F089855DC24360BC8CE2CFA9C3DBF31A9C31CD937BAE7DBEDA96F4C598BA1E1812E73BB664E60CF12913A24ACE899A307B2FB8ECD6F0
                                        Malicious:false
                                        Preview:................l........*.......8.......8.......9...... 9......'9......29......A9......T9......[9......j9......|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:......$:......-:......::......L:......R:......\:......i:......o:......x:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......;.......;.......;.......;..#...$;..N...H;..=....;..)....;.......;.......<..0...-<......^<.......=.......=..0....=.......=.......=.......=..*....=......)>..-...9>......g>......o>.......>.......>.......>.......>.......>.......>.......?......!?......<?......X?......t?.......?.......?.......?.......?.......?.......?.......?.......?.......@.......@......-@......:@......L@......[@......z@.......@.......@.......@..O....@..o....@..!...gA..K....A..1....A.......B.......B..9...$B..8...^B.......B.......B.......B..(....B.......B.......B..2....C......<C......VC......bC......oC......|C.......C.......C.......C.......C......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\ta_IN\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 39 messages, Project-Id-Version: electrum '\340\256\207\340\256\265\340\257\215\340\256\265\340\256\277\340\256\237\340\256\244\340\257\215\340\256\244\340\256\277\340\256\262\340\257\215 \340\256\222\340\256\260\340\257\201 \340\256\252\340\256\260\340\256\277\340\256\265\340\256\260\340\257\215\340\256\244\340\257\215\340\256\244\340\256\251\340\257\210 \340\256\225\340\256\237\340\257\215\340\256\237\340\256\243\340\256\256\340\257\215 \340\256\252\340\256\260\340\256\277\340\256\250\340\257\215\340\256\244\340\257\201\340\256\260'
                                        Category:dropped
                                        Size (bytes):3933
                                        Entropy (8bit):5.26212156261863
                                        Encrypted:false
                                        SSDEEP:96:YiNReugw5WCs7LYbxdE4iD/15i6TNtiDte9cadVlv:YiXPTWCsHY/4D11NcjWlv
                                        MD5:D19E6DFBBBFD4D6415780A44F821824B
                                        SHA1:F32B3CFDC75EB6924C2ED59A2D2EC4397149482B
                                        SHA-256:EAD72F879C18C7970EFC80DD1EB7DB0ABC1ED20EF1DD3E849EF328330E400C36
                                        SHA-512:497A99287A38549921CACC1C4C91B2F7D2308AA56EE6646C074FEDED12CE4ABBFEA8027119208EBF2245FA548F1995DC96A70E24143386A8F363919F8E8172CA
                                        Malicious:false
                                        Preview:........'.......T...5...........`.......a...............................".......9.......@.......H...c...`.........................................................................../...........K.......S.......e.......|..........................."...................!.......6.......S.......j................... ..............................................................."...........&.......9..."...F..."...i...%...............................................J...........S.......`.......s...............................;.......N.......g.......z.......................................................................................0.......@.......M...............................................................................................................$.......................%... ..."...........&...............#...............!...'........................A suggested fee is automatically added to this field. You may override it. The suggested fee increases with the size of the transaction

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\th_TH\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 386 messages, Project-Id-Version: electrum ' (No FX rate available)'
                                        Category:dropped
                                        Size (bytes):42055
                                        Entropy (8bit):5.271881615004976
                                        Encrypted:false
                                        SSDEEP:768:LtFmbbWX/Xyw+slsDWX1sXnJRI9V8LZvWVz6p+1nga9VpMZycwRfmuegYHCm3lqN:LrYWX/iw+slsDWSXLz+WdEkuBDA/yHpD
                                        MD5:B3AEE2FB6C4947D00E300D4FB5E3C2F6
                                        SHA1:EBB68C565E973F46891A49686D7D7BFFB3BF7B2D
                                        SHA-256:485D1C7BD377FD61E4E15492050ACCBE648221F5CE2C8867DFC67AB37A2F984F
                                        SHA-512:3359D170BA06B9671EDA50A04C5994665F9E4E97EBD3D0BA6DD8C60AB37588EB8B79E3C71CF811072EA3CFE7809BE6558BCB363F7DB3A4A2004023C4544F88EC
                                        Malicious:false
                                        Preview:................,.......<.......` ......a ......z ....... ....... ....... ....... ....... ....... ....... ....... ....... .......!.......!.......!......,!......7!......B!......W!......]!......e!......r!......z!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......!......."......."......."......""......7"......@"......G"......N"......T"......\"......m"......s"......z"......."..K...."..0...."..m....#..#...w#.......#..=...l$..)....$.......$.......$..0....%..4...3%......h%.......&.......&.......'......-'......9'..'...K'..*...s'.......'..-....'.......'.......'.......'.......(.......(......7(......O(......g(......~(.......(.......(.......(..R....(.......).."....)......<)..7...O)..O....).......).......).......*..)....*......1*......M*......^*......k*......}*.......*..;....*..,....*.......+......%+......++..O...2+..o....+..2....+..!...%,..K...G,..1....,.......,.......,..9....,..8....-......U-......a-......v-..(....-.......-.......-..`....-..b...(...2...........

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\tr_TR\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1069 messages, Project-Id-Version: electrum ' (D\303\266viz kuru yok)'
                                        Category:dropped
                                        Size (bytes):75365
                                        Entropy (8bit):5.352463961007435
                                        Encrypted:false
                                        SSDEEP:1536:hBxRfNdrbhukCdUhFFdumvcXE+7i94ttHDWBgb7:vXfnnWiFOE+7V9DWU7
                                        MD5:73E73DED000AA69FA5A6A7A297A9AA52
                                        SHA1:3D1E2F510EEE3493F4535509F56D4683166E0587
                                        SHA-256:33CDDD896DF7CFADD0B0B3ABE47D08AB0A8F0F5DCC46985C926C813C5DDE2ED1
                                        SHA-512:3C1CB6C6DB0760738C8DE57DE34925F8A72AD76FCC054CBE98698D5F9885655F988015A2A63319EE29C29355D88B7BEA965F7B1EF4CAFE9D55A206197058024B
                                        Malicious:false
                                        Preview:........-........!.......B......8Y......9Y......RY......`Y......gY......rY.......Y.......Y.......Y.......Y.......Y.......Y.......Y.......Y.......Y.......Z.......Z.......Z....../Z......5Z......=Z......JZ......RZ......dZ......mZ......zZ.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......[.......[......#[......,[......3[......:[......@[......H[......Y[......_[......f[......m[..K...x[..m....[..#...2\......V\..N...']..=...v]..)....].......].......]..0....^..4...=^......r^......._......._..0...._......._......._.......`.......`.......`..'...1`......Y`......h`......|`..-....`.......`.......`.......`.......`.......`.......a..M...'a......ua.......a.......a.......a.......a.......a.......b......(b......Db......`b......}b.......b.......b.......b.......b.......b.......b.......b.......c.......c.......c..7...(c..O...`c.......c.......c.......c..)....c.......d......&d......7d......Dd......Vd......ed.......d..;....d..,....d.......d.......e.......e......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\uk_UA\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1324 messages, Project-Id-Version: electrum ' (\320\235\320\265\320\264\320\276\321\201\321\202\321\203\320\277\320\275\320\260 \321\226\320\275\321\204\320\276\321\200\320\274\320\260\321\206\321\226\321\217 \320\277\321\200\320\276 \320\272\321\203\321\200\321\201 \320\276\320\261\320\274\321\226\320\275\321\203)'
                                        Category:dropped
                                        Size (bytes):156483
                                        Entropy (8bit):5.480518723378095
                                        Encrypted:false
                                        SSDEEP:3072:T5b0SqAIVw+slspZolkYJeE+g8uCFnBGU6VPvsh0IhDqf+0c:3H+QZ2xX8f8
                                        MD5:6D49E672FA1F9EF6AEB36FE9184FB696
                                        SHA1:5765C3B04D33D1BFEE469C7A74E0356D09AEA6F6
                                        SHA-256:56FDAA05055D1A5311141BBDF9B1D768602FB0CB0BD9AE388FB199E29EBBCEDD
                                        SHA-512:7E37C4CBEF8CCB3B4EF5F327826A8F3FB58A70444F9BFB85C28112593241BF7DB4337AD799E070D2D9DFFED9B570C566E94C659F5F402CB87CD6E794A21E6035
                                        Malicious:false
                                        Preview:........,.......|).......R.......n.......n.......n.......n.......n.......n.......n.......n.......o.......o......$o......=o......Eo......Ko......Yo......do......oo.......o.......o.......o.......o.......o.......o.......o.......o.......o.......o.......o.......o.......p.......p.......p......!p......0p......<p......Ip......Op......dp......mp......tp......{p.......p.......p.......p.......p.......p.......p..K....p..m....q..#...sq..=....q..)....q.......q.......r..0...-r..4...^r.......r......6s.......s......Bt..0...Xt.......t.......t.......t.......t..'....t..*....t.......u..-...)u......Wu......_u......ou.......u.......u.......u.......u.......u.......u.......v......+v......Fv......bv......~v.......v.......v.......v.......v.......v..R....v......<w......@w..7...Sw..O....w.......w.......w.......x..)....x......5x......Qx......bx......ox.......x.......x..;....x..,....x.......y......)y......4y......:y..O...Ay..o....y..2....z..!...4z..K...Vz..1....z.......z.......z..8....z......*{......6{......K{..(...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\vi_VN\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 212 messages, Project-Id-Version: electrum ' (Kh\303\264ng c\303\263 \304\221\303\241nh gi\303\241 FX s\341\272\265n c\303\263)'
                                        Category:dropped
                                        Size (bytes):14470
                                        Entropy (8bit):5.453162760413832
                                        Encrypted:false
                                        SSDEEP:192:fz2DrLU4mGUbpbNWD8UVdOPXr+vAJDQCDDbjohsxsvhJ4g6RfYUUU6RAb6oMVenT:6k4yNbsD8UVdX8TJmvU3UU3iVg+wyQ
                                        MD5:44262E945465E2FF48001D5A73B11206
                                        SHA1:1BB40E65B6F2C1901802D71DFD805CC29C049BDB
                                        SHA-256:EDB58370DD8A4F8B6246D17FC36623ADC9992ECBCD1D02F34A07682C1970F623
                                        SHA-512:D0B0A06BCE7C4117B803378C45FDE078B41A50CFA5605BB163039527EEB6B2D5451E045BCA3B3CBF8E302F53BDE731C75B3C68F0ECC0BC343670FA0953FB74BB
                                        Malicious:false
                                        Preview:........................\...............................................................$.......+.......:.......L.......e.......m.......s...............................................................................................................".......,.......9.......?.......H.......V.......\.......k.......w...................................................................................)...........................................................................................).......4.......9.......A.......Y.......c.......}...........c...)...............................................................................................0...F..._...O...........................................................&.......:.......L.......Y.......n.......w.......|.........................................................................../...........5.......=.......J..."...j...................j..........."...f...7...........G.......1.......-...(...4...V...4...................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\zh_CN\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 2447 messages, Project-Id-Version: electrum ' (\346\227\240\345\217\257\347\224\250\346\261\207\347\216\207)'
                                        Category:dropped
                                        Size (bytes):225849
                                        Entropy (8bit):6.2687401634019295
                                        Encrypted:false
                                        SSDEEP:3072:Pq0PJWCkLkR6tGcHVw+slsuTiMwsvFylTK7gMV2YE+/2lULUC+kA+Q+Ldb09cFVz:PqEJWVS6sOswI2dFkZ0Sk8R
                                        MD5:D39ACB07795ACA6D83CC799FD7DAA863
                                        SHA1:515D187EC46EEFE3201FEF5F8263C3B9539BA8CF
                                        SHA-256:5370DB5CB0CB9B757CCF70B149C227C70368AFA56335FCEADA28669F2DAAF43A
                                        SHA-512:0CCFE9554A96BF9BBE433428778772C093243C7E294A3913CC3D68ABB54EF501B0EF8E4522271CBAA62EE37D9852239D98169F7B1811C2DB5048B6E39D8688D9
                                        Malicious:false
                                        Preview:.................L..............(.......).......B.......P.......W.......b.......q.......................................................................................................%.......-.......:.......B.......T.......].......j.......w.......~.......................................................................................................................#.......*.......0.......8.......I.......W... ...g...........$.......%...............'........... .......&.......-...;...4.......p...K...{...0.......m.......#...f...........N...[...=.......)...................!...0...@...4...q...............I...........L...U...>.......................0...........:.......J.......Y.......l...................................................'.......,.......'...<...&...d...+.......*.......................3.......1...9..."...k...........-...................................................'.......5.......O.......k...................M...........................4.......T.......s.......................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\locale\zh_TW\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 594 messages, Project-Id-Version: electrum ' (\345\214\257\347\216\207\350\263\207\350\250\212\344\270\215\345\217\257\347\224\250)'
                                        Category:dropped
                                        Size (bytes):44423
                                        Entropy (8bit):5.975443020349473
                                        Encrypted:false
                                        SSDEEP:768:WmVjCLKlanTuejb+/nKt4PKmabE+rwxgZUWNk17w/wgDdg1TTopWWOLf5cAQai9:Wij0KcnTDbOnKt4PKm+E+r0ckC4Dog94
                                        MD5:01CD1BDAB79C7ADE9836812A2B963C4D
                                        SHA1:FB94BCC16AA883CF402DA1DEB6BFA2F7A0313F2F
                                        SHA-256:9DAF20DCE1BF729AED92B46B515269BD50A4C4AEDC4942414E167EFBE247A786
                                        SHA-512:F594545356DEB2412E44058CBE7EB3018986F664651662BA1CAE11F434B8BD33263AF75EBB0F183DD97EE9C9B105E8FBAF7B3A68EC1503E4A72B8700B5D6AEFE
                                        Malicious:false
                                        Preview:........R...............<%.......1.......1.......1.......1.......1.......1.......1.......2.......2......"2......42......M2......U2......[2......n2......|2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......3.......3.......3......!3......'3......03......>3......D3......S3......_3......l3......r3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3..K....3..0...(4......Y4..N...*5..=...y5..)....5.......5.......5..0....6..4...@6......u6.......7.......7......$8......:8......I8......U8..'...g8..*....8.......8..-....8.......8.......9.......9......"9......99......S9......k9.......9.......9.......9.......9.......9.......:.......:......):..R...2:.......:.."....:.......:.......:..7....:..O....;......[;..K...i;.......;.......;..)....;.......<.......<.......<......;<......M<..'...\<.......<.......<..,....<.......<.......<.......<.......=..O....=..o...X=..2....=..!....=..K....>..1...i>.......>.......>..9....>.......>.......>.......?......

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\README

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):1525
                                        Entropy (8bit):4.308909802534244
                                        Encrypted:false
                                        SSDEEP:24:Rg1PepJW3MdGwZVc/qVRHv9Fv8Rx8tPhAjOTNkNITuGTkAz+pzoAxq4iZv9q3A:q12pJYSGnSVRHTv8R8yjOpBTkAovRiZz
                                        MD5:C818A526EC8E002419BB86F9B791AE21
                                        SHA1:6633DCF0BDAF6DA74BEE0DA01FC67D36A130DF69
                                        SHA-256:A4A22B8BF021FEB1096C611F4F5A9EDA63D6C189A5609C1460718EBF87FABB17
                                        SHA-512:541EA923A28BE16A6940E0306D62DE71BC4D25DD1E85E17B80DFF5568F3BA63EFDAD5B6EF259E797E300B7DF0644DC796F8754259AB95625F43BDE672673B2C4
                                        Malicious:false
                                        Preview:Plugin rules:.. * The plugin system of Electrum is designed to allow the development. of new features without increasing the core code of Electrum... * Electrum is written in pure python. if you want to add a feature. that requires non-python libraries, then it must be submitted as a. plugin. If the feature you want to add requires communication with. a remote server (not an Electrum server), then it should be a. plugin as well. If the feature you want to add introduces new. dependencies in the code, then it should probably be a plugin... * We expect plugin developers to maintain their plugin code. However,. once a plugin is merged in Electrum, we will have to maintain it. too, because changes in the Electrum code often require updates in. the plugin code. Therefore, plugins have to be easy to maintain. If. we believe that a plugin will create too much maintenance work in. the future, it will be rejected... * Plugins should be compatible with Electrum's convention

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1164
                                        Entropy (8bit):5.131212790283945
                                        Encrypted:false
                                        SSDEEP:24:UIxok4JHWWV0yPP3VtkHe1oai9QHlsUjH8Ok46+d5Eo3DqeFs:UMotJdVlPvLTmawQHlsyHIO5d3D1Fs
                                        MD5:4F2F1D52356EF8175E80B790A2CC8004
                                        SHA1:F30F2EE67771A1B57AEA74319F6CBD49B55BDB11
                                        SHA-256:D05BF2C5E001E8642AC43A0399F4681C48E94A1FEB2D37EE073E243D7547735E
                                        SHA-512:7329029BF99337D0A1B353BF155F66E09B1200263E4F4CCA898CBD1E145F53A5573AF85FF0453DF54B196544F888FD3C6C0CD5DCE35599D5ABCD3826939B1569
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - lightweight Bitcoin client.# Copyright (C) 2015 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\audio_modem\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):214
                                        Entropy (8bit):4.927871904173466
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhF17v6IFP8EGYGP1/JFuAyEKLfKhbfOVrI7:1YvQJF176eVTQ/pyEKKAV07
                                        MD5:6790EF548CB2261AD89A53C5C3D0CFF4
                                        SHA1:422AB91148D7A45B9F95E2A866C42A112DD3AE85
                                        SHA-256:0A038364785B2A50A43A3EBB2ADB079E1DA54D81F050FC815A6B4025D723650E
                                        SHA-512:0D8CDAA2A8B6EB90184E84817A7E6C13277580AD98B2B8E555167EB4CD935FE5B6DAA800170723C1A34E3C8BF5E8D9DE0062B64B2A97F7E99B564F808EE255DF
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = _('Audio MODEM').description = _('Provides support for air-gapped transaction signing.').requires = [('amodem', 'http://github.com/romanz/amodem/')].available_for = ['qt']..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\audio_modem\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):4293
                                        Entropy (8bit):4.671629688157907
                                        Encrypted:false
                                        SSDEEP:96:k6IjmUaWG4flas0JqWRfR5y9VzJqC/Mz4T4M:kBIly97AC4M
                                        MD5:F1069BB5F0A50A1BCE038DF8944355A8
                                        SHA1:AB214EAF4EEF7FBDF9A26824026183AF5B13964D
                                        SHA-256:37C15EE2AC33135163692FA35F63F2297D77BA3DFDF8E0AF6547CBB70C45CBF1
                                        SHA-512:2B93A3E9D4F7D3528D7A515D6EF5846F1F31AAC3F4B7CD3EAB13BD7CBFB1A5E6D427F0B954C311B45E82B7B49846D59A4577FAC81AF25BD15B3412C4C89CD191
                                        Malicious:false
                                        Preview:from functools import partial.import zlib.import json.from io import BytesIO.import sys.import platform.from typing import TYPE_CHECKING..from PyQt5.QtWidgets import (QComboBox, QGridLayout, QLabel, QPushButton)..from electrum.plugin import BasePlugin, hook.from electrum.gui.qt.util import WaitingDialog, EnterButton, WindowModalDialog, read_QIcon.from electrum.i18n import _.from electrum.logging import get_logger..if TYPE_CHECKING:. from electrum.gui.qt.transaction_dialog import TxDialog..._logger = get_logger(__name__)...try:. import amodem.audio. import amodem.main. import amodem.config. _logger.info('Audio MODEM is available.'). amodem.log.addHandler(amodem.logging.StreamHandler(sys.stderr)). amodem.log.setLevel(amodem.logging.INFO).except ImportError:. amodem = None. _logger.info('Audio MODEM is not found.')...class Plugin(BasePlugin):.. def __init__(self, parent, config, name):. BasePlugin.__init__(self, parent, config, name). if self.is

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\bitbox02\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):342
                                        Entropy (8bit):4.81573664495697
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhHpXeeawJ6IFlX2UEiVMr8/KI+eQhCag03KNQohQiIXdQGVbRC:1YvQJJXeRwJ6AXxVVWST+p0aNAJIX2Gi
                                        MD5:A4F7A31824929EEEB0B69FE5AE80F9BE
                                        SHA1:3114463FA7C37DC91487FE3DEDFA5C13E33A9DF8
                                        SHA-256:868C0438C6AC79EB4A5AE1CF57A0649EB20C9DD936256A553A5269E2826AE08B
                                        SHA-512:2D703F9C0BBD34319739531ED482DEB3C143026A18A8FFF76A942BF24D832C5E02266935BD77E7594DA72D218F1E90C727C9B10DCC6B16445F6265C1072A7196
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = "BitBox02".description = (. "Provides support for the BitBox02 hardware wallet".).requires = [. (. "bitbox02",. "https://github.com/digitalbitbox/bitbox02-firmware/tree/master/py/bitbox02",. ).].registers_keystore = ("hardware", "bitbox02", _("BitBox02")).available_for = ["qt"].

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\bitbox02\bitbox02.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):28018
                                        Entropy (8bit):4.48147860211988
                                        Encrypted:false
                                        SSDEEP:384:5Maamch5a5d9w8QwUUvK4pDP/p7KXPS7Ig:5Vw8QuvK4pDP/4Xg
                                        MD5:F04F6DA3B6341CA22848C3F7851150A6
                                        SHA1:A4BD9AA3D6933AFA602A9C6FDC32626C78D504CE
                                        SHA-256:026B76DFAE55C369527F3C8B508D8354EB6D4A3D82B8BD5C89ED1180B14F5BB1
                                        SHA-512:FE367C78857EAE07A2B89F732A70D6312C066B5AC1ED54AAD32DD866D58A5094C08AD5D8D604FA2CDBBA621AD70084647E7F058C733C67408ED891158F20AB60
                                        Malicious:false
                                        Preview:#.# BitBox02 Electrum plugin code..#..import hid.from typing import TYPE_CHECKING, Dict, Tuple, Optional, List, Any, Callable..from electrum import bip32, constants.from electrum.i18n import _.from electrum.keystore import Hardware_KeyStore.from electrum.transaction import PartialTransaction, Sighash.from electrum.wallet import Multisig_Wallet, Deterministic_Wallet.from electrum.util import UserFacingException.from electrum.logging import get_logger.from electrum.plugin import Device, DeviceInfo, runs_in_hwd_thread.from electrum.simple_config import SimpleConfig.from electrum.storage import get_derivation_used_for_hw_device_encryption.from electrum.bitcoin import OnchainOutputType..import electrum.bitcoin as bitcoin.import electrum.ecc as ecc..from ..hw_wallet import HW_PluginBase, HardwareClientBase, HardwareHandlerBase..if TYPE_CHECKING:. from electrum.wizard import NewWalletWizard.._logger = get_logger(__name__)...try:. from bitbox02 import bitbox02. from bitbox02 import ut

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\bitbox02\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):5643
                                        Entropy (8bit):4.7627608623319
                                        Encrypted:false
                                        SSDEEP:96:jQmy0hAHGWr0R30XV1SfInwJy9vDlptPHmsqJCHsUqTTSh:kaGmvOL8o9lrqzSh
                                        MD5:E03CB4AEDED7CEF59F49FEBE14025E2A
                                        SHA1:2D795898789DE87CE04643664A9D23FDDFC07001
                                        SHA-256:944725841380108F2FDFFD8A76920108D95D9BC45AB3C5C1EFC2BD16734A4E7A
                                        SHA-512:CD9F67AF1F488DFAD5F4FFFD138CB80676C8D963BB2102460CED826724284E8E970E0332218119952FF7880B7CC477F326F372486E3D2411F70BE8D8A2F8F0E0
                                        Malicious:false
                                        Preview:import threading.from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt, QMetaObject, Q_RETURN_ARG, pyqtSlot, pyqtSignal.from PyQt5.QtWidgets import QLabel, QVBoxLayout, QLineEdit, QHBoxLayout..from electrum.i18n import _.from electrum.plugin import hook.from electrum.util import UserCancelled, UserFacingException..from .bitbox02 import BitBox02Plugin.from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available, OperationCancelled..from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWUnlock, WCHWUninitialized, WCHWXPub.from electrum.gui.qt.util import WindowModalDialog, OkButton, ButtonsTextEdit..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard...class Plugin(BitBox02Plugin, QtPluginBase):. icon_unpaired = "bitbox02_unpaired.png". icon_paired = "bitbox02.png".. def create_handler(self, window):. return BitBox02_Handler(window)..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\coldcard\README.md

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):1599
                                        Entropy (8bit):4.733667781245139
                                        Encrypted:false
                                        SSDEEP:48:3w/sAYSjlkL2p9tJW0AL7gdNlnymtgaAW2VXOYM:3w/CSjU2p9tQ0BNlnyXM2NBM
                                        MD5:E23ECE2F407341B9321074891D211AA0
                                        SHA1:DAAC9FD399D8DD6BDA56092331BE11B0D302F2C1
                                        SHA-256:1988F0E2EE3452D900B75440A500F2CC0AEA7F4FCE4DFEB19353FF46651ECC67
                                        SHA-512:1F582B451A8FA9B47F38FD3CE4843E1E6164E0FBB05FEC9EA218865BB0D8A6680B199B7CFEA74E0E1E1BF5FFAFAC2A3C4ECCCB0E07C6EA099F658FACBBD46817
                                        Malicious:false
                                        Preview:# Coldcard Hardware Wallet Plugin..## Just the glue please..This code connects the public USB API and Electrum. Leverages all.the good work that's been done by the Electrum team to support.hardware wallets...## Background..The Coldcard has a larger screen (128x64) and a number pad. For.this reason, all PIN code entry is done directly on the device..Coldcard does not appear on the USB bus until unlocked with appropriate.PIN. Initial setup, and seed generation must be done offline...Coldcard uses the standard for unsigned tranasctions:..PSBT = Partially Signed Bitcoin Transaction = BIP174..The Coldcard can be used 100% offline: it can generate a skeleton.Electrum wallet and save it to MicroSD card. Transport that file.to Electrum and it will fetch history, blockchain details and then.operate in "unpaired" mode...Spending transactions can be saved to MicroSD using by exporting them.from transaction preview dialog (when this plugin is.owner of the wallet). That PSBT is then signed on the C

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\coldcard\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):308
                                        Entropy (8bit):4.780432453957694
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhcBTRXrml6IFX0myCDKJSpEG+dwS0wKNQo6KcPleQXBGVrIeCM7in:1YvQJwg6xmyCDKgarBt2x2GV0dM+n
                                        MD5:EA4F01C6131621AE973CEB62B3DBC196
                                        SHA1:F1A6745F5CA08BBB972C08D3CFB374CA6B65AC98
                                        SHA-256:A25ABE5EE2830E4EE8C47D45A6FC5D4A202E0ADB08FCF6C2026108FAF3518D8F
                                        SHA-512:AD11CD1FC57EC3D2A6B0D7DFF5C71F420967502EFF971CEC9E2651AE3463645B30B0E6300053684491367837A548A79FF4C9E56C97CF673E09491F50DB7726C6
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Coldcard Wallet'.description = 'Provides support for the Coldcard hardware wallet from Coinkite'.requires = [('ckcc-protocol', 'github.com/Coldcard/ckcc-protocol')].registers_keystore = ('hardware', 'coldcard', _("Coldcard Wallet")).available_for = ['qt', 'cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\coldcard\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1090
                                        Entropy (8bit):4.573310061544046
                                        Encrypted:false
                                        SSDEEP:24:1/d1AZBPxya0mPxrnD8PxS1XXmrxxuPwHvsb/aC9sahfA0yGl:dvAVb0Krn4AixIsvwaCVZ5
                                        MD5:8870C7B7E30C1CD7FD068D93A5E3B6DE
                                        SHA1:EED10756BCF0F33C70F13FAD219462F53DB9FA5D
                                        SHA-256:CD39D765EBB9C0F55B3D7C81C7300B824342E24B3D361AD6A62838665FA99447
                                        SHA-512:82922FEF123FB09E3C334E1C8597D3737498C50B155758144BFAD328CB47734FF7E0CFE7919911136D058709A86BEAE16D88386F2C1BE9C862834550C7FE5DA0
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from electrum.util import print_msg, raw_input, print_stderr.from electrum.logging import get_logger..from ..hw_wallet.cmdline import CmdLineHandler..from .coldcard import ColdcardPlugin..._logger = get_logger(__name__)...class ColdcardCmdLineHandler(CmdLineHandler):.. def get_passphrase(self, msg, confirm):. raise NotImplementedError.. def get_pin(self, msg, *, show_strength=True):. raise NotImplementedError.. def prompt_auth(self, msg):. raise NotImplementedError.. def yes_no_question(self, msg):. print_msg(msg). return raw_input() in 'yY'.. def stop(self):. pass.. def update_status(self, b):. _logger.info(f'hw device status {b}').. def finished(self):. pass..class Plugin(ColdcardPlugin):. handler = ColdcardCmdLineHandler().. @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\coldcard\coldcard.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):24659
                                        Entropy (8bit):4.600096072868321
                                        Encrypted:false
                                        SSDEEP:384:ET7cFOAFQcAsm0nxFG3iEOtkVtZOTJc8vIVp5DUsAtN:60ulfZrL5DUPv
                                        MD5:AE37F81847578906E1BB368CB99C6E5E
                                        SHA1:3CE722E0F590E777ACC40148D20D9B87638A74FF
                                        SHA-256:E7273E605B53806F92EB490198218841B4BCE3C716EDDB87B48DDB294B4C48C6
                                        SHA-512:4EE95AD84F93FD8A0268D89410571C866EFEB65CFC4E3DEA9AEF9B927E1D59B2D3F89AFBFEF873ED0C206D89EDE4266C66BDC9406F5833832952DCBF44CA992E
                                        Malicious:false
                                        Preview:#.# Coldcard Electrum plugin main code..#.#.import os.import time.from typing import TYPE_CHECKING, Optional.import struct..from electrum import bip32.from electrum.bip32 import BIP32Node, InvalidMasterKeyVersionBytes.from electrum.i18n import _.from electrum.plugin import Device, hook, runs_in_hwd_thread.from electrum.keystore import Hardware_KeyStore, KeyStoreWithMPK.from electrum.transaction import PartialTransaction.from electrum.wallet import Standard_Wallet, Multisig_Wallet, Abstract_Wallet.from electrum.util import bfh, versiontuple, UserFacingException.from electrum.logging import get_logger..from ..hw_wallet import HW_PluginBase, HardwareClientBase.from ..hw_wallet.plugin import LibraryFoundButUnusable, only_hook_if_libraries_available..if TYPE_CHECKING:. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard.._logger = get_logger(__name__)...try:. import hid. from ckcc.protocol import CCProtocolPacker, CCProtocolUnpacker. from ckcc.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\coldcard\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):9720
                                        Entropy (8bit):4.7607121749672
                                        Encrypted:false
                                        SSDEEP:192:CCEIRwrvz1dIK2P6ua6NG9UFOi2j1HMjK94:TEI64Sx9UFOi2j1HP4
                                        MD5:39CA9012A128A6A73D6FB1D6A806BC3E
                                        SHA1:3B58E78EB9F910A41E5A64244E4D86214CD53268
                                        SHA-256:EF2C9F1027D540A42683E57AE249D6835ED7DDB69762C3C8460B4A7400C265D3
                                        SHA-512:91D1954B41FA490DA3C390956A14C4423879CD1E3A54FA48DDB873C6CA2D8374626A7221A0270257E5AEBFB79EA326DA251581AFBDA9AE5B070EF5A9503C7511
                                        Malicious:false
                                        Preview:from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt.from PyQt5.QtWidgets import QPushButton, QLabel, QVBoxLayout, QWidget, QGridLayout..from electrum.gui.qt.util import WindowModalDialog, CloseButton, getOpenFileName, getSaveFileName.from electrum.gui.qt.main_window import ElectrumWindow..from electrum.i18n import _.from electrum.plugin import hook.from electrum.wallet import Multisig_Wallet..from .coldcard import ColdcardPlugin, xfp2str.from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available.from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWXPub, WCHWUninitialized, WCHWUnlock..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard..CC_DEBUG = False...class Plugin(ColdcardPlugin, QtPluginBase):. icon_unpaired = "coldcard_unpaired.png". icon_paired = "coldcard.png".. def create_handler(self, window):. return Coldcard_Handler

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\cosigner_pool\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):380
                                        Entropy (8bit):4.759186715601759
                                        Encrypted:false
                                        SSDEEP:6:1YvQdLhFiE7bqMrI+7FVYlARbJvNAk1ThEGe5BMysT/ALeHAfmG/QBwxC3P532Ld:1YvQJh6Mrj7FVRvRTS/ngNgeGc6YGli0
                                        MD5:E2BB461D422E50929D6997B2DBE21A2F
                                        SHA1:5E177F624FAB2BA8937CDE5CC79E83FBDA438840
                                        SHA-256:BB99B42569DC28A3A8D6EB372575952B5AD08B9B384F6BB16A10CE60015D4EC8
                                        SHA-512:C4CE543D86B449816003A79D0210356020EBD0035B69721C8CB5571B18D44D14C2DBA2D4356691EB361C3B4852B50CFBBE39A518370FA612A66FE3B2B5829674
                                        Malicious:false
                                        Preview:from electrum.i18n import _.fullname = _('Cosigner Pool').description = ' '.join([. _("This plugin facilitates the use of multi-signatures wallets."),. _("It sends and receives partially signed transactions from/to your cosigner wallet."),. _("Transactions are encrypted and stored on a remote server.").]).#requires_wallet_type = ['2of2', '2of3'].available_for = ['qt'].

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\cosigner_pool\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):11676
                                        Entropy (8bit):4.662484746362187
                                        Encrypted:false
                                        SSDEEP:96:rzPjdwQHzJD3qvLm0tY9SOUuW3hEnp1ak/WG4/tjBec8kRvcsnAvGta6OPSiMKCO:rdwQHduvLm9rUr3hY11et8PIXQWcSc
                                        MD5:34E953135C8DC4322C18F89B4EEBFAAC
                                        SHA1:022B9442792DF41089999CE15620BC71F736E991
                                        SHA-256:BCD052A9DD43F50DA83B3F2597B3E7F8BAC12DA590F50E594CAEBE037599C726
                                        SHA-512:4393985BDAB65A5B12B564D071AD6EC2D008CB319083D9929F16FE07315846AA6A05C398038A95E2DA84812EACDC7A52A9754DF71CEC6711DFBFC5855DF42F07
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - lightweight Bitcoin client.# Copyright (C) 2014 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\digitalbitbox\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):241
                                        Entropy (8bit):4.784377531884513
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhiMpgrBkv6IFQWFngKNQo6K1AayX+WGVrIeCM7in:1YvQJiEgFa6pWFg21AXHGV0dM+n
                                        MD5:444DDD276080B4DE4EFACE108A2DAAF9
                                        SHA1:0A0BBC93200366A16B9E215F9A9FA587113B5B4D
                                        SHA-256:96C60D1D9FEDE5EF8010000FC6241BEAC23112C120A52953B52BE3428147F5D7
                                        SHA-512:8646AF3BC3A6916881C82CD5AA1BF6E986E652E633060A485200CE29DF1E32A48D0DE9A9561708606A28B7341535AADCE347A1BEDC9597C751E5BE062A806807
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Digital Bitbox'.description = _('Provides support for Digital Bitbox hardware wallet').registers_keystore = ('hardware', 'digitalbitbox', _("Digital Bitbox wallet")).available_for = ['qt', 'cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\digitalbitbox\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):419
                                        Entropy (8bit):4.548925765726323
                                        Encrypted:false
                                        SSDEEP:12:1KM82l8nDMz+85QDMm2Hvsb/aCTATSvehahBNA099a/:1/+fj6Hvsb/aC9sahfA0y/
                                        MD5:8631469CD0F206ADAB39997AA499CA9C
                                        SHA1:BC5FF5912135E8E31473B8FAD264E5ABFF199A15
                                        SHA-256:4CB7671A72CDE8A9F782897998568E89547C41D3C3AE41C5CC4306AB43E75B20
                                        SHA-512:A3E0D3BD49DD7E6BCB9E7D432B0D63EF82187A8FA2D9D1543E40683F06473C3D1BD0849E68B68497E32102661A1A5285C186E13ACEDC3904EB217C8715215A43
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from .digitalbitbox import DigitalBitboxPlugin.from ..hw_wallet import CmdLineHandler..class Plugin(DigitalBitboxPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\digitalbitbox\digitalbitbox.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):32787
                                        Entropy (8bit):4.5602859394966755
                                        Encrypted:false
                                        SSDEEP:192:CuqD+/3dlB3r92cNM+QbBR5pF1ohL0ET/8/snK/+JFVWn9OxhEaDmXLiJzcaVCRl:CfwDFr3IpUOsnKeFwnbL36bt7sfafM
                                        MD5:B7051A3F11741AB137504C97C06BDEE6
                                        SHA1:09EB8F9F873DA6AFFE4897F968D6BC8C3C4547CE
                                        SHA-256:675F51AC01C4E4A5FA0FC63346DFC3E9ECCB74832C5B4554B5A93541D9B9DC60
                                        SHA-512:4BB3656BDF45F64305A87148268F867AB8163DC4D0FB804784DBC58F36F4C714E86307F364C5BDC23C2BAEE020EC2B67D5785EBFC5F2E160B6951D9145F98857
                                        Malicious:false
                                        Preview:# ----------------------------------------------------------------------------------.# Electrum plugin for the Digital Bitbox hardware wallet by Shift Devices AG.# digitalbitbox.com.#..import base64.import binascii.import hashlib.import hmac.import json.import math.import os.import re.import struct.import sys.import time.import copy.from typing import TYPE_CHECKING, Optional..from electrum.crypto import sha256d, EncodeAES_bytes, DecodeAES_bytes, hmac_oneshot.from electrum.bitcoin import public_key_to_p2pkh.from electrum.bip32 import BIP32Node, convert_bip32_intpath_to_strpath, is_all_public_derivation.from electrum.bip32 import normalize_bip32_derivation.from electrum import descriptor.from electrum import ecc.from electrum.ecc import msg_magic.from electrum.wallet import Standard_Wallet.from electrum import constants.from electrum.transaction import Transaction, PartialTransaction, PartialTxInput, Sighash.from electrum.i18n import _.from electrum.keystore import Hardware_KeyStore.from

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\digitalbitbox\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3917
                                        Entropy (8bit):4.690719249837408
                                        Encrypted:false
                                        SSDEEP:48:j3rmoVL0OH4FFmOxJMCzJ0OOb8rNo+th5yfKOvdRBTOkttRtT58YyCawfjHwd80k:jbmU0dMCV0aR77yVV1ttzTvaqTZXSZq
                                        MD5:A6DDE05E304B8218F0016BBA47BA0DB2
                                        SHA1:C05FFF43F9E8C5E803FB3A7CA552A3B945EA8E94
                                        SHA-256:34E29A7E9D26DA850F634BF97F82C74A925C31369ADF1C55AFE4390F25443E4F
                                        SHA-512:8114478507BFC4CD3E4D47B8F485F84EDD660E8BE94F3BC3C98578718CAEDF8386C1451EA7DDF826A05FB69CD0CCC721FB0F3E83D6087BB3F268C8438FBAB0AD
                                        Malicious:false
                                        Preview:import threading.from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import pyqtSignal..from electrum.i18n import _.from electrum.plugin import hook.from electrum.wallet import Standard_Wallet, Abstract_Wallet.from electrum.util import UserCancelled, UserFacingException..from electrum.plugins.hw_wallet.qt import QtHandlerBase, QtPluginBase.from electrum.plugins.hw_wallet.plugin import only_hook_if_libraries_available, OperationCancelled..from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWXPub, WCHWUnlock..from .digitalbitbox import DigitalBitboxPlugin, DeviceErased..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard...class Plugin(DigitalBitboxPlugin, QtPluginBase):. icon_unpaired = "digitalbitbox_unpaired.png". icon_paired = "digitalbitbox.png".. def create_handler(self, window):. return DigitalBitbox_Handler(window).. @only_hook_if_libraries_available. @hook. def receive_menu(self,

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\hw_wallet\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):111
                                        Entropy (8bit):4.457214322966268
                                        Encrypted:false
                                        SSDEEP:3:1LVepMIgBi6MC8EwnN/sunV1HZGYM0FbQ5k0tiBin:1LVMMIiR8EU/JxZnJQ5IU
                                        MD5:52B30DA28E218397BF0F197CD012BFE4
                                        SHA1:682C77DD610B00FEB531C9229DFD06597E31D056
                                        SHA-256:43DC75F64615B1D390CDE8CE4367AF134CA91910EB9C93FE821F83DACB3BC893
                                        SHA-512:B4C9074A5E8CB05F2CA92112113BC3246E72E80EDD30C212CEA051F2E361597F1BB468DE07B8C889DF961F067DD6E447C65EFC78C75D265284753127BE1FFBB1
                                        Malicious:false
                                        Preview:from .plugin import HW_PluginBase, HardwareClientBase, HardwareHandlerBase.from .cmdline import CmdLineHandler.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\hw_wallet\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1354
                                        Entropy (8bit):4.514970029818741
                                        Encrypted:false
                                        SSDEEP:24:1VZL3NbAa0G4tFi6qXVnDsUlQsXv1rZXrxT:Ll0TelnBXZ7xT
                                        MD5:31CBDC01F67F32923C164021DAAFBA02
                                        SHA1:BE5E95880A57BA0752399391354594D4EEE26EDB
                                        SHA-256:49FF231904D9153C4DEFD35024A69B111E05859D20B8B96C4DB7E6988C46DEDC
                                        SHA-512:8E479BAB7A053FA6A518AA8D925B7C590029866E4A3474A8630A8AD358F3745CF57AEF59B888C1B72DEE6B3A5861514158BDB7983A19257F4D524A645E2788F0
                                        Malicious:false
                                        Preview:from electrum.util import print_stderr, raw_input.from electrum.logging import get_logger..from .plugin import HardwareHandlerBase..._logger = get_logger(__name__)...class CmdLineHandler(HardwareHandlerBase):.. def get_passphrase(self, msg, confirm):. import getpass. print_stderr(msg). return getpass.getpass('').. def get_pin(self, msg, *, show_strength=True):. t = {'a':'7', 'b':'8', 'c':'9', 'd':'4', 'e':'5', 'f':'6', 'g':'1', 'h':'2', 'i':'3'}. print_stderr(msg). print_stderr("a b c\nd e f\ng h i\n-----"). o = raw_input(). try:. return ''.join(map(lambda x: t[x], o)). except KeyError as e:. raise Exception("Character {} not in matrix!".format(e)) from e.. def prompt_auth(self, msg):. import getpass. print_stderr(msg). response = getpass.getpass(''). if len(response) == 0:. return None. return response.. def yes_no_question(self, msg):.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\hw_wallet\plugin.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):14828
                                        Entropy (8bit):4.752524911800716
                                        Encrypted:false
                                        SSDEEP:192:qdwQHddv9pE4nGha4ZDSFDAS67yJO4vCKbewqpcyT2fPWnO/IN20SBjq:roFvG/DovJVdK2m1NO2
                                        MD5:4961B8C84883E8668B0A1E2870BF6C9A
                                        SHA1:31FD90FE0C1BB917C43169545C5601B12C7B4027
                                        SHA-256:05B583AF1AAAB88A008BF0D30EF6713875605CFFB93BDD0C435D91FD785414AD
                                        SHA-512:52B6475FE55BD9B3AA7E5B71DCD79880EC0FFF37670CE2FA403571EE1654803C41BDE627C78B504E99F1A234E2AD7111FE05FF022C8FBDA14AABBA52DC9D1BE6
                                        Malicious:false
                                        Preview:#!/usr/bin/env python2.# -*- mode: python -*-.#.# Electrum - lightweight Bitcoin client.# Copyright (C) 2016 The Electrum developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY C

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\hw_wallet\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):12498
                                        Entropy (8bit):4.757921295230046
                                        Encrypted:false
                                        SSDEEP:192:fdwQHdEXHvK0ceFB/KKMDcsfJ+Fkclm82FE8:moaXhFB/WDGFkX82+8
                                        MD5:53D4E492727BAD18D344E2CC928102BE
                                        SHA1:8D55EF3E4620EC8161C22CA1273B05CAD78434E2
                                        SHA-256:0B33414FC749DE7F7D36E5B46DE6DF6E90BC6B74EB84D32CE911D77A1E74852E
                                        SHA-512:D63345E2EAE2624C3E35A95E2193EE1B2ED3DAFD8DB9F4B0D0BA9171533F7446CFE37DCC9D9EF1D988156852C46E405EE349E565F40DCEAFD488C6E484025830
                                        Malicious:false
                                        Preview:#!/usr/bin/env python3.# -*- mode: python -*-.#.# Electrum - lightweight Bitcoin client.# Copyright (C) 2016 The Electrum developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY C

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\jade\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):268
                                        Entropy (8bit):4.8235012599608265
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhkAtml6IFwoGSXBnAJaCwKNQo6KcB4WGVrIeCM7in:1YvQJU6VoHB+a/2cBBGV0dM+n
                                        MD5:94FF5D020EE819D7986259DC69CBE476
                                        SHA1:CB9E3A7C1955A5836299F31ABCC6447B0C9F059C
                                        SHA-256:95C1142F731D619652DB103AB62EE229635073CBEE3878804458B1DD9D1359CF
                                        SHA-512:D0F0B7A192FD2F7927445E48842C8C9041BCBC0E8CB122F30A3539BC86D10A46FD3962588C38629B3E64D305D06AFFF087E7F06CBEEC190A6E45A326ABEFBAA8
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Blockstream Jade Wallet'.description = 'Provides support for the Blockstream Jade hardware wallet'.#requires = [('', 'github.com/')].registers_keystore = ('hardware', 'jade', _("Jade wallet")).available_for = ['qt', 'cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\jade\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):392
                                        Entropy (8bit):4.463179374677607
                                        Encrypted:false
                                        SSDEEP:12:1KM82Jco7+85zO2Hvsb/aCTATSvehahBNA099a/:1/46Hvsb/aC9sahfA0y/
                                        MD5:F5C6F4BA4953FAFB51A4B7114E9F1D6D
                                        SHA1:6D4D4029C28416520D82788C72FC9018510697CF
                                        SHA-256:89FF53B27FE9B3308E8713925EF92B92C4896196134D9EF1F9FFA78C1AF0D83A
                                        SHA-512:D4A6C9340E7CB9B6CBE4B7F82E2D9FFA026A24B98F47D088F406AC185B19A584BB1DDB91FB11916F66D5D5FB6A628E7B3E8FB9EB73429C17DD58E0E401BDBAD8
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from .jade import JadePlugin.from ..hw_wallet import CmdLineHandler..class Plugin(JadePlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\jade\jade.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Objective-C source, ASCII text
                                        Category:dropped
                                        Size (bytes):20012
                                        Entropy (8bit):4.605564270785093
                                        Encrypted:false
                                        SSDEEP:192:0pjCMMNzjZxMYDVKnP0dCHfHElhTu8HPHlRN5tD9c/cnEYPlNDc9GR8JDq+mHLVu:1F9PHxiCEoM9GR8kceuXd829mBQ
                                        MD5:F9D7283439EB46A7F3E2BB0B16F5A552
                                        SHA1:F0D4A307EF71421957411B28F2E16B45AC419989
                                        SHA-256:F21458090D738DB78BE55AEF43F4EB4827FF570604E21878736C9A014116190A
                                        SHA-512:F0F9E16E9248DB189B8B86141FEDB89CE38328CACCA8421EFCF05EC27A17071994F3DC5C52B45EA885288F3223D2F14D34BEEDBB99F5C08EF8E63013FBEC54AE
                                        Malicious:false
                                        Preview:import os.import base64.import json.from typing import Optional, TYPE_CHECKING..from electrum import bip32, constants.from electrum.crypto import sha256.from electrum.i18n import _.from electrum.keystore import Hardware_KeyStore.from electrum.transaction import Transaction.from electrum.wallet import Multisig_Wallet.from electrum.util import UserFacingException.from electrum.logging import get_logger.from electrum.plugin import runs_in_hwd_thread, Device.from electrum.network import Network..from electrum.plugins.hw_wallet import HW_PluginBase, HardwareClientBase.from electrum.plugins.hw_wallet.plugin import OutdatedHwFirmwareException..if TYPE_CHECKING:. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard.._logger = get_logger(__name__)..#import logging.#LOGGING = logging.INFO.#if LOGGING:.# logger = logging.getLogger('jade').# logger.setLevel(LOGGING).# device_logger = logging.getLogger('jade-device').# device_logger.setLevel(LOGGING)

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\jade\jadepy\README.md

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):477
                                        Entropy (8bit):4.828758399992962
                                        Encrypted:false
                                        SSDEEP:12:lNQvTNJMaRaEFe13FksD7+8yC1hGQ7VWzFs9zBYo:lyvTyqaksDCfCCiyOVBR
                                        MD5:75DD2797E93EAD1742A774920FDD14F8
                                        SHA1:85FC59323948E8D4DA50571F25AA8E8E9CD3A226
                                        SHA-256:7AE641BADDE92ABFFF7CD61769574CB2E3997CE9E6ACF7ADA5D67780974DDA23
                                        SHA-512:1F5AEA6A5FDC9B0882D2E5786B7A5B8980A6926BCBA3E0AF40691AD8789E0314CA76487A903E6A1EB72588CB1DBC38C4ECC68DB82DBBF02EF68BAD2A3E6EBC1D
                                        Malicious:false
                                        Preview:# Python Jade Library..This is a slightly modified version of the official [Jade](https://github.com/Blockstream/Jade) python library...This modified version was made from tag [1.0.29](https://github.com/Blockstream/Jade/releases/tag/1.0.29)...Intention is to fold these modifications back into Jade repo, for future api release...## Changes.- Removed BLE module, reducing transitive dependencies.- _http_request() function removed, so cannot be used as unintentional fallback.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\jade\jadepy\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):83
                                        Entropy (8bit):4.356008886282579
                                        Encrypted:false
                                        SSDEEP:3:1LPHJivNDZLP4XYXRvSw1AXLvHd:1LPcvRZLP4qvSw129
                                        MD5:F8686A13EDF81D1653C8645C5EBE4F20
                                        SHA1:E071EFD7E0EFA22DE7605157591C2B242B96315E
                                        SHA-256:DBAE5D8E80228D433FB80C02750AE17B0D329F6DCCFB880775A4794530CE4517
                                        SHA-512:7F600D316486ED3E7AD937021B92B3B1FBD9CE7E8FBFAC6ED901DB60481C493F05CE9E007CD46760EFF693C44CCFAB5D5D5FA581F85DF876F54CADCF8185593D
                                        Malicious:false
                                        Preview:from .jade import JadeAPI.from .jade_error import JadeError..__version__ = "0.2.0".

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\jade\jadepy\jade.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):79303
                                        Entropy (8bit):4.3460139233710935
                                        Encrypted:false
                                        SSDEEP:1536:ZpEvUPU4m9VpPTpb1z9biNDXi5Fe5Y5cjI753jIF58P4Q:ZpEsPUN9V3hz9biZXi5Fe5yCM7
                                        MD5:FE29B974BC72B2282AE49C509D90E234
                                        SHA1:96360F8510FE8FF6C3518C3618BBA3712D85ACA1
                                        SHA-256:8A2F9B549A59BC975E8508082008F17DC8279C7C8EEF8CAEF55CF5F7BE672C41
                                        SHA-512:F586D63C4B93192D67A85815BEDDA52BD571D9B43502DBD70788A958B56993E6C899F0C286E6A777B7454D9E8C03EE871A920A284FD9673CBDEE7286FFA424A1
                                        Malicious:false
                                        Preview:import cbor2 as cbor.import hashlib.import json.import time.import logging.import collections.import collections.abc.import traceback.import random.import sys..# JadeError.from .jade_error import JadeError..# Low-level comms backends.from .jade_serial import JadeSerialImpl.from .jade_tcp import JadeTCPImpl..# 'jade' logger.logger = logging.getLogger(__name__).device_logger = logging.getLogger(f'{__name__}-device')..# BLE comms backend is optional.# It relies on the BLE dependencies being available.try:. from .jade_ble import JadeBleImpl.except ImportError as e:. logger.warning(e). logger.warning('BLE scanning/connectivity will not be available')...# Default serial connection.DEFAULT_BAUD_RATE = 115200.DEFAULT_SERIAL_TIMEOUT = 120..# Default BLE connection.DEFAULT_BLE_DEVICE_NAME = 'Jade'.DEFAULT_BLE_SERIAL_NUMBER = None.DEFAULT_BLE_SCAN_TIMEOUT = 60...def _hexlify(data):. """. Helper to map bytes-like types into hex-strings. to make for prettier message-logging...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\jade\jadepy\jade_error.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):655
                                        Entropy (8bit):4.853248167454973
                                        Encrypted:false
                                        SSDEEP:12:ircH+wToOd/kVka5OE1IZtsNXOXGk7O+3Lp1ASpBmkQbnDBVFHwBobLClWi5PJQ:eOoOdxa5o2NWL3HAJDnjRfCt5m
                                        MD5:57A66152722C693FA838635A8E12EB69
                                        SHA1:6480550846EFE74DBBDE6443EB7E119932F6D523
                                        SHA-256:A50A952A33A1924CC9E26FE465270ECFCB21E3D5F55FF3B3E69E697BD0790CBD
                                        SHA-512:04B401EDB9DC82F6DA202E56BEC6685754797AB915E9DFB6710C21FC2E32D22D0FA8FAC7F0E3FF49CDD65D9404106078EF97C74621A87B53754EB3B7E2DE403E
                                        Malicious:false
                                        Preview:class JadeError(Exception):. # RPC error codes. INVALID_REQUEST = -32600. UNKNOWN_METHOD = -32601. BAD_PARAMETERS = -32602. INTERNAL_ERROR = -32603.. # Implementation specific error codes: -32000 to -32099. USER_CANCELLED = -32000. PROTOCOL_ERROR = -32001. HW_LOCKED = -32002. NETWORK_MISMATCH = -32003.. def __init__(self, code, message, data):. self.code = code. self.message = message. self.data = data.. def __repr__(self):. return "JadeError: " + str(self.code) + " - " + self.message \. + " (Data: " + repr(self.data) + ")".. def __str__(self):. return repr(self).

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\jade\jadepy\jade_serial.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):2409
                                        Entropy (8bit):4.522427183467439
                                        Encrypted:false
                                        SSDEEP:48:Y2qGafD6PkzvZOP3tRV+LvMjzU+JRRxgEpIXZCjSajDSajVaLcz:JC64ZOlKL0jwWjKskwjSaPSa5awz
                                        MD5:540D0596B313F4AEE4A3C2C79474F54A
                                        SHA1:EF797F0D318B405CAC21FDE31DACEF51C2A110CA
                                        SHA-256:607F28362D02D11AE7F6A0A6BF27DA4473D0753301131C6CC78DB0EC96306C0B
                                        SHA-512:CEAB738896C45E095759DEEFF50862A0611C57363248F110764D1AC69F68205117FFF398FEA4ACFC328ED353B04A69FDD5FC227EE50AD263644D0C37DD4FD126
                                        Malicious:false
                                        Preview:import serial.import logging..from serial.tools import list_ports..logger = logging.getLogger(__name__)...#.# Low-level Serial backend interface to Jade.# Calls to send and receive bytes over the interface..# Intended for use via JadeInterface wrapper..#.# Either:.# a) use via JadeInterface.create_serial() (see JadeInterface).# (recommended).# or:.# b) use JadeSerialImpl() directly, and call connect() before.# using, and disconnect() when finished,.# (caveat cranium).#.class JadeSerialImpl:. # Used when searching for devices that might be a Jade/compatible hw. JADE_DEVICE_IDS = [. (0x10c4, 0xea60), (0x1a86, 0x55d4), (0x0403, 0x6001),. (0x1a86, 0x7523), (0x303a, 0x4001), (0x303a, 0x1001)].. @classmethod. def _get_first_compatible_device(cls):. jades = []. for devinfo in list_ports.comports():. if (devinfo.vid, devinfo.pid) in cls.JADE_DEVICE_IDS:. jades.append(devinfo.device).. if len(jades) > 1:.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\jade\jadepy\jade_tcp.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1797
                                        Entropy (8bit):4.658503094088295
                                        Encrypted:false
                                        SSDEEP:24:xPOaVpKF8JP3B1fSlxAfCK0nX5mYcgvYD0fAh7uwZSq6Q:xGafDJPHSLvKIX56JD2AcwZSqP
                                        MD5:0E15909E3B79C998D5682057CFC2AB82
                                        SHA1:6C26C4C84492A523D0589EEC3F3A61AD57080FAF
                                        SHA-256:9EA17CF844FE568B2ADD6615CBC52C2079711D1740147FA3FB8DF2C6EEC8776F
                                        SHA-512:DEEB72938BC0ACF705E2EBFF39054BDEE338181F5A1468387EB442DDD31FF14D4ACD0CB09CF1B437F74B1D60DF6801C71FB2A1FDC1A4D1B01FCD8D8D20D39260
                                        Malicious:false
                                        Preview:import socket.import logging...logger = logging.getLogger(__name__)...#.# Low-level Serial-via-TCP backend interface to Jade.# Calls to send and receive bytes over the interface..# Intended for use via JadeInterface wrapper..#.# Either:.# a) use via JadeInterface.create_serial() (see JadeInterface).# (recommended).# or:.# b) use JadeTCPImpl() directly, and call connect() before.# using, and disconnect() when finished,.# (caveat cranium).#.class JadeTCPImpl:. PROTOCOL_PREFIX = 'tcp:'.. @classmethod. def isSupportedDevice(cls, device):. return device is not None and device.startswith(cls.PROTOCOL_PREFIX).. def __init__(self, device, timeout):. assert self.isSupportedDevice(device). self.device = device. self.timeout = timeout. self.tcp_sock = None.. def connect(self):. assert self.isSupportedDevice(self.device). assert self.tcp_sock is None.. logger.info('Connecting to {}'.format(self.device)). self.tcp_s

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\jade\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1957
                                        Entropy (8bit):4.929104544059974
                                        Encrypted:false
                                        SSDEEP:48:GrmoSFmmxbjC6uT0OOvCr/3P5yfKwvdRBRWSBhtR5qvT:Emhju0UDByBXBBhtnqb
                                        MD5:C7BD3F19C3E127B8E80154D13C5D1AC6
                                        SHA1:F572850A7796535350168B0DED273601CB8D2A22
                                        SHA-256:9EB8DC82A40FFA87E6FE4E0BAA078300DBE99C1E3E0A0C564B0A243311A849E3
                                        SHA-512:59FD1AE49AAC47B9ABD421EAB8E92C9DB7E66F87DB35DE1EBADBE0F8BC4C934E43A3753F43F5D09E50F99BF03D05931AED6FA7BAA8A2B64E5DFC1976B150C108
                                        Malicious:false
                                        Preview:from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import pyqtSignal..from electrum.i18n import _.from electrum.plugin import hook.from electrum.wallet import Standard_Wallet..from electrum.plugins.hw_wallet.qt import QtHandlerBase, QtPluginBase.from electrum.plugins.hw_wallet import plugin.from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWUnlock, WCHWXPub, WCHWUninitialized..from .jade import JadePlugin..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard...class Plugin(JadePlugin, QtPluginBase):. icon_unpaired = "jade_unpaired.png". icon_paired = "jade.png".. def create_handler(self, window):. return Jade_Handler(window).. @plugin.only_hook_if_libraries_available. @hook. def receive_menu(self, menu, addrs, wallet):. if type(wallet) is not Standard_Wallet:. return. keystore = wallet.get_keystore(). if type(keystore) == self.keystore_class and len(add

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\keepkey\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):278
                                        Entropy (8bit):4.821030196603601
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rh2kv6IFpy3aOtA8ocvfPiQCwKNQo6Ku1lXoWGVrIeCM7in:1YvQJ2a6IyqOtRocvfPiQ/2u1lXRGV09
                                        MD5:2D76E42E310E58826CAD4056848CF239
                                        SHA1:F6708F9012B5392B24BA550D9E56FC0A39E20AC6
                                        SHA-256:04EDF5BBE67D915C59089E4CFA3A024C0B935D2CB79D6A1D19421D4B820F3A32
                                        SHA-512:5EEA97C182C07425E10EEB7F4BAD05D6D9276D91F4874AD87B43368C24680E41C798BD1B06EFF7B8592D89C6148AF5A610C4D61C27FDD73AB363292221B16F8B
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'KeepKey'.description = _('Provides support for KeepKey hardware wallet').requires = [('keepkeylib','github.com/keepkey/python-keepkey')].registers_keystore = ('hardware', 'keepkey', _("KeepKey wallet")).available_for = ['qt', 'cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\keepkey\client.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):528
                                        Entropy (8bit):4.608127851066862
                                        Encrypted:false
                                        SSDEEP:12:1ti9PRXZI6ZVc0F2PVcoI90x1AF9AJnIyAJ9cDA6Jn4YJIAKgcVPf:1tiLpBF2PVsuAF9APAbYA6JnPif
                                        MD5:737BCE725B560E515F20EB78E709C52B
                                        SHA1:1B80436158FCD7C20E94E9F524DD8149FCBA9F4F
                                        SHA-256:CEF7C998629FA73AD4CF51F0F1DFA58446E1369DFEAA19FBDA87097CA42D1B6B
                                        SHA-512:592BFB18211BDE040FCD8CEA13F06A28142059B1C0D43649EC62C92CC9469C8148300AF1E34BA0AEBA1F0F06B0D4B5E8CB2E6EDD2E385023D2A8EE89200CDFD9
                                        Malicious:false
                                        Preview:from keepkeylib.client import proto, BaseClient, ProtocolMixin.from .clientbase import KeepKeyClientBase..class KeepKeyClient(KeepKeyClientBase, ProtocolMixin, BaseClient):. def __init__(self, transport, handler, plugin):. BaseClient.__init__(self, transport). ProtocolMixin.__init__(self, transport). KeepKeyClientBase.__init__(self, handler, plugin, proto).. def recovery_device(self, *args):. ProtocolMixin.recovery_device(self, False, *args)...KeepKeyClientBase.wrap_methods(KeepKeyClient).

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\keepkey\clientbase.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):10023
                                        Entropy (8bit):4.498583976268572
                                        Encrypted:false
                                        SSDEEP:192:C4ttM/vCo5J11DkuY6yAlvegqD2B0oyCGOyiwvt:3tEvM40D2WoyDXb
                                        MD5:4969BD8849EE7B2BB2B86C6866616FAE
                                        SHA1:3D749ABD433B407A577752520CB781A3A68FD043
                                        SHA-256:A267A398D357E2FE3D31C10E975716913924561A0FCA029AFED309A305DE3508
                                        SHA-512:C81DB92B001AAC7C9C9853E978BF589A60AFE476659ABF0922ECF6ADC7A9560A74C8D7A4CC0A917600897AD6291C63DD3A557C5C2B983C0F5C1AEF3652FFDC72
                                        Malicious:false
                                        Preview:import time.from struct import pack.from typing import Optional..from electrum import ecc.from electrum.i18n import _.from electrum.util import UserCancelled.from electrum.keystore import bip39_normalize_passphrase.from electrum.bip32 import BIP32Node, convert_bip32_strpath_to_intpath.from electrum.logging import Logger.from electrum.plugin import runs_in_hwd_thread.from electrum.plugins.hw_wallet.plugin import HardwareClientBase, HardwareHandlerBase...class GuiMixin(object):. # Requires: self.proto, self.device. handler: Optional[HardwareHandlerBase].. messages = {. 3: _("Confirm the transaction output on your {} device"),. 4: _("Confirm internal entropy on your {} device to begin"),. 5: _("Write down the seed word shown on your {}"),. 6: _("Confirm on your {} that you want to wipe it clean"),. 7: _("Confirm on your {} device the message to sign"),. 8: _("Confirm the total amount spent and the transaction fee on your ". "{

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\keepkey\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):401
                                        Entropy (8bit):4.468576579494682
                                        Encrypted:false
                                        SSDEEP:12:1KM82T6ZVE+857AAyn2Hvsb/aCTATSvehahBNA099a/:1/TSzw82Hvsb/aC9sahfA0y/
                                        MD5:30E746E99CABA2DD38EFBF677668B08C
                                        SHA1:728CF6052FCBD8505FF30DEB811338099A11BAE3
                                        SHA-256:572B3024F467EB5606F89D7C48C72005178537A1D8AA4BD18008A2AED2A0826F
                                        SHA-512:930011E39A6C68E6D367292D009D2CEF37927BDBE732DE579D42E86305CE60DF4132689D9EAC0A9E15E5F15C261D3000222B5997599506C0B03C7F49DEF2B91E
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from .keepkey import KeepKeyPlugin.from ..hw_wallet import CmdLineHandler..class Plugin(KeepKeyPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\keepkey\keepkey.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):18435
                                        Entropy (8bit):4.497557488972594
                                        Encrypted:false
                                        SSDEEP:192:4InEP87YTnl+DaeGInJq7ZBQUQmAUo3h4qbIOvlzoVOD7ZwcPnCkjVCK5P+F1J:REE7Yl+wA3IOX3Wgnp0EK
                                        MD5:3179FED1DC739CB21AB7567C24A1CDD4
                                        SHA1:075756B8A4F620F526A11B13D82BE761AAC668A1
                                        SHA-256:F7DF6248C7C7E305189975C2B1200BCE781527DA6CE8EB5E7B4EAB6D36805756
                                        SHA-512:FFC1D27D3C1BEA3EBE4C82A772E70AC36DB061E42C1BB89AA616421AC7CEE7B0FA1453CFAAD989CADBA642FF06BE4230971185FFBF16D1CAD5E45F412A51D390
                                        Malicious:false
                                        Preview:from typing import Optional, TYPE_CHECKING, Sequence..from electrum.util import UserFacingException.from electrum.bip32 import BIP32Node.from electrum import descriptor.from electrum import constants.from electrum.i18n import _.from electrum.transaction import Transaction, PartialTransaction, PartialTxInput, Sighash.from electrum.keystore import Hardware_KeyStore.from electrum.plugin import Device, runs_in_hwd_thread..from ..hw_wallet import HW_PluginBase.from ..hw_wallet.plugin import is_any_tx_output_on_change_branch, trezor_validate_op_return_output_and_get_data..if TYPE_CHECKING:. import usb1. from .client import KeepKeyClient. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard...# TREZOR initialization methods.TIM_NEW, TIM_RECOVER, TIM_MNEMONIC, TIM_PRIVKEY = range(0, 4)...class KeepKey_KeyStore(Hardware_KeyStore):. hw_type = 'keepkey'. device = 'KeepKey'.. plugin: 'KeepKeyPlugin'.. def decrypt_message(self, sequence, messag

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\keepkey\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):29123
                                        Entropy (8bit):4.644533633229949
                                        Encrypted:false
                                        SSDEEP:768:LbK1gtqeyIERy5vVSjlmmvi4wJa4z1xKXxVIz:LbKeRyIERy59SjlmSi4Ma4z1xKXT0
                                        MD5:28A6682EC9A4BC4590A28DCA6E01A9D4
                                        SHA1:D34C9E90D74B75C7BB261E3DD76171799A79C220
                                        SHA-256:71EAE26CA283109E3F98D9757A72D4CA82ACBC7F86B998BD293DB2A0A85D5856
                                        SHA-512:A20EB7B082AEDADF88EF77CF1ACE3D48F4D254FB35AE833438C5003CAAEF0DF20C44B0AC01211599488D6A75CD758F53FC2FE9B9943D62FAF886E7042A8401CE
                                        Malicious:false
                                        Preview:import threading.from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt, QEventLoop, pyqtSignal, QRegExp.from PyQt5.QtGui import QRegExpValidator.from PyQt5.QtWidgets import (QVBoxLayout, QLabel, QGridLayout, QPushButton,. QHBoxLayout, QButtonGroup, QGroupBox, QDialog,. QTextEdit, QLineEdit, QRadioButton, QCheckBox, QWidget,. QMessageBox, QSlider, QTabWidget)..from electrum.gui.qt.util import (WindowModalDialog, WWLabel, Buttons, CancelButton,. OkButton, CloseButton, ChoiceWidget).from electrum.i18n import _.from electrum.plugin import hook.from electrum.logging import Logger..from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available.from .keepkey import KeepKeyPlugin, TIM_NEW, TIM_RECOVER, TIM_MNEMONIC, TIM_PRIVKEY..from electrum.gui.qt.wizard.wallet import WCScriptAndDeriv

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\labels\Labels.qml

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):976
                                        Entropy (8bit):4.266424000445255
                                        Encrypted:false
                                        SSDEEP:24:I60KUhGhBlgaXgne6DqtnRIqmAzA1cmPcr4c1UL:I60KUhGblh16Otnv3k1re4XL
                                        MD5:63333160BA67AB698C70BDA33EB05C36
                                        SHA1:0EC3C196CF478AA9DA3BA909E0E748492E4DF860
                                        SHA-256:D61F0650C154C214B5235DC7AA6D75435B25C3642E1E84823BEA864493F5B741
                                        SHA-512:4E5D76DF424F2A4E0249F8198DA0531B1A3F326D16A4FF567896FFE7AE1236E895B56877A24C572169C490426E82E834AB81677225DB624FEEC89D9FF2F865A9
                                        Malicious:false
                                        Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.14.import QtQuick.Controls.Material 2.0..import org.electrum 1.0..//import "controls"..Item {. width: parent.width. height: rootLayout.height.. property QtObject plugin.. RowLayout {. id: rootLayout. Button {. text: 'Force upload'. enabled: !plugin.busy. onClicked: plugin.upload(). }. Button {. text: 'Force download'. enabled: !plugin.busy. onClicked: plugin.download(). }. }.. Connections {. target: plugin. function onUploadSuccess() {. console.log('upload success'). }. function onUploadFailed() {. console.log('upload failed'). }. function onDownloadSuccess() {. console.log('download success'). }. function onDownloadFailed() {. console.log('download failed'). }. }.}.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\labels\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):353
                                        Entropy (8bit):4.662360886198234
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhtg9bOsxY3/PbdoBdkAFcmFkM/AYXMDGeh0or1fmCFfgy3mPGVrIeCRI4/:1YvQJ+Rxco0AmmFFvMD/2aeUfiGV0dRn
                                        MD5:21448A626D1CD28546563118CA9AC337
                                        SHA1:ED3E2C021DD395DE0E6C882DCF99E9F243B14D35
                                        SHA-256:A70D9912CC5E610131698A3A38961DD66C735D831A833BEBD7058C50E3CDC112
                                        SHA-512:BC12ABB6B649D5A786A4CA2AA8A2AEBD48CFC944D7DD99A37438FC9AC09DD8F0F371762365411141A1003B8B673811FF8D980C19CF4985BE69BA03142FD767D7
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = _('LabelSync').description = ' '.join([. _("Save your wallet labels on a remote server, and synchronize them across multiple devices where you use Electrum."),. _("Labels, transactions IDs and addresses are encrypted before they are sent to the remote server.").]).available_for = ['qt', 'qml', 'cmdline']..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\labels\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):271
                                        Entropy (8bit):4.460627159720854
                                        Encrypted:false
                                        SSDEEP:6:1LJyQsOXJKMMIin4BOZCzLM0twRL0JXg3U6IaT/XhMZamv:18QuM8lp0KRUamv
                                        MD5:96C7F006F00DEC601B732FC566A8C9EE
                                        SHA1:031CEBAB7EAECB151C0E777A1FC4FF825638853B
                                        SHA-256:3DC8658B4F1F0FC29C6B889F94713135A9D36B5DFA05252E4D33D343E96A9974
                                        SHA-512:60976A78CCC1632176E1CBAA76073014B3BBD984F6C7D8287580EEDF151C1E027EC41020BAF3E35FEB7E0D8CC7FE2519805E02A6B4F32C86A3664381DD55A798
                                        Malicious:false
                                        Preview:from .labels import LabelsPlugin.from electrum.plugin import hook..class Plugin(LabelsPlugin):.. @hook. def load_wallet(self, wallet, window):. self.start_wallet(wallet).. def on_pulled(self, wallet):. self.logger.info('labels pulled from server').

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\labels\labels.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):8160
                                        Entropy (8bit):4.481185503293974
                                        Encrypted:false
                                        SSDEEP:96:qfpwF+mxbhqAGWG4oPUXwzRYcYXfLUw7X3bmQHu1AnJGHVOz0Sma3d1Ko5q:qfXC8gv9vmCZcYz0k8
                                        MD5:9718897C830CD910B320453624FAB3E0
                                        SHA1:993297EF438553F6E77E5682F9E4FCDF685743C3
                                        SHA-256:96A7FA4C6244019B4B13F44982B6300179E420769A662F9A50A541035AA09757
                                        SHA-512:516E0FA5010A844B2731929F8E024073530D6A517D1CA5EBB0BE3DE800CB80FC9E282F4DDAF951F279C4BFACFBD4980F6B79124659AFA6F7F23DBE2F1AFBF070
                                        Malicious:false
                                        Preview:import asyncio.import hashlib.import json.import sys.import traceback.from typing import Union, TYPE_CHECKING..import base64..from electrum import util.from electrum.plugin import BasePlugin, hook.from electrum.crypto import aes_encrypt_with_iv, aes_decrypt_with_iv.from electrum.i18n import _.from electrum.util import log_exceptions, ignore_exceptions, make_aiohttp_session.from electrum.network import Network..if TYPE_CHECKING:. from electrum.wallet import Abstract_Wallet...class ErrorConnectingServer(Exception):. def __init__(self, reason: Union[str, Exception] = None):. self.reason = reason.. def __str__(self):. header = _("Error connecting to {} server").format('Labels'). reason = self.reason. if isinstance(reason, BaseException):. reason = repr(reason). return f"{header}: {reason}" if reason else header...class LabelsPlugin(BasePlugin):.. def __init__(self, parent, config, name):. BasePlugin.__init__(self, parent, con

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\labels\qml.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):4142
                                        Entropy (8bit):4.383682861028925
                                        Encrypted:false
                                        SSDEEP:96:jcmMppNvgN3t97NE9q7vIbYg37QeBfBYhB:YZp1ioDRhGhB
                                        MD5:080032F17E18E29FC7C25CC5B9AB1382
                                        SHA1:6B1A86637A697BD9A8A63D9788C36B6954837D1D
                                        SHA-256:9C436F742E50C1E7602DA5EEF3D31BDCB996A0DEBDC4531E18F7F53501DD77E5
                                        SHA-512:92142E61A92FD560752531CD067A60AD220048C91A95599D4D97513D7532E705875FBCA389BBC9B698EE05907445606E8ABDC33D6F6E43F97D8C893381DC540C
                                        Malicious:false
                                        Preview:import threading..from PyQt6.QtCore import pyqtSignal, pyqtSlot..from electrum.i18n import _.from electrum.plugin import hook..from electrum.gui.qml.qewallet import QEWallet.from electrum.gui.common_qt.plugins import PluginQObject..from .labels import LabelsPlugin...class Plugin(LabelsPlugin):.. class QSignalObject(PluginQObject):. labelsChanged = pyqtSignal(). uploadSuccess = pyqtSignal(). uploadFailed = pyqtSignal(). downloadSuccess = pyqtSignal(). downloadFailed = pyqtSignal().. _name = _('LabelSync Plugin').. def __init__(self, plugin, parent):. super().__init__(plugin, parent).. @pyqtSlot(result=str). def settingsComponent(self): return '../../../plugins/labels/Labels.qml'.. @pyqtSlot(). def upload(self):. assert self.plugin.. self._busy = True. self.busyChanged.emit().. self.plugin.push_async().. def upload_finished(self, result):.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\labels\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3613
                                        Entropy (8bit):4.632841276996006
                                        Encrypted:false
                                        SSDEEP:96:gqm6FOZvbgrjd0jbvjhX34df9xJ96X1Jp:gqhqLjh44X3p
                                        MD5:31E333482CBF6401028D4CFF6E807307
                                        SHA1:75F2CB9A3F425A4064057946D5D2F1C7E222ED07
                                        SHA-256:5EBDD56C0E9BEAC63935D957AE145117D01F7EE0DE779C45C6D72F32FC48834F
                                        SHA-512:26C95AF6EE071C1EDB8E273BC245EEA251F383D580F8B35B7E24AF5A3FE8BDC7D5F85FB4A5C0DF89E014145F1AC8B9B12F14D3914143B109024C78B9669E3887
                                        Malicious:false
                                        Preview:from functools import partial.import traceback.import sys.from typing import TYPE_CHECKING..from PyQt5.QtCore import QObject, pyqtSignal.from PyQt5.QtWidgets import (QHBoxLayout, QLabel, QVBoxLayout)..from electrum.plugin import hook.from electrum.i18n import _.from electrum.gui.qt.util import ThreadedButton, Buttons, EnterButton, WindowModalDialog, OkButton..from .labels import LabelsPlugin..if TYPE_CHECKING:. from electrum.gui.qt import ElectrumGui. from electrum.gui.qt.main_window import ElectrumWindow. from electrum.wallet import Abstract_Wallet..class QLabelsSignalObject(QObject):. labels_changed_signal = pyqtSignal(object)...class Plugin(LabelsPlugin):.. def __init__(self, *args):. LabelsPlugin.__init__(self, *args). self.obj = QLabelsSignalObject(). self._init_qt_received = False.. def requires_settings(self):. return True.. def settings_widget(self, window: WindowModalDialog):. return EnterButton(_('Settings'),.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\ledger\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):285
                                        Entropy (8bit):4.84363630841645
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhqA0Opml6IFCKkJMKNzEmGgvXwKNQo6KcbJZH+WGVrIeCM7in:1YvQJqLt68/KNgt2aRGV0dM+n
                                        MD5:93C97180066580C721162F2D8A58D0E8
                                        SHA1:A65514D33C88A9A4EBABD81D41C93111177D75EE
                                        SHA-256:D9D094304691A391B0DB294F4741C8F838B07BA821E70E98EC8AB2433AC8484B
                                        SHA-512:D42647048E9CA3A597FF776A55A1D1C7FED3968826E1DF91126029A2A13A9B7930C5B66B9B3F3B2EB8F417E50895A2EB8E8983680B68B4EAEEDA407C34295B96
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Ledger Wallet'.description = 'Provides support for Ledger hardware wallet'.requires = [('ledger_bitcoin', 'github.com/LedgerHQ/app-bitcoin-new')].registers_keystore = ('hardware', 'ledger', _("Ledger wallet")).available_for = ['qt', 'cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\ledger\auth2fa.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):7022
                                        Entropy (8bit):4.747407652681403
                                        Encrypted:false
                                        SSDEEP:192:1JAljLvMF9F0tNyydkVHSMEdUoavFfbpGPQS:SjAF9F0tNyydGSMEdUoavFfbpGPQS
                                        MD5:9C1C046D745D8B69FAAD6816ECC3CDC3
                                        SHA1:A533767A31D529B7D474DBEFC20DFF760262C276
                                        SHA-256:37AAFAF43AA20413B58BA98144BD6DD0C9D392815B7FE8768D873C8FB170A353
                                        SHA-512:3464005E9FC850E9E317F4002E3D265DDB1BD54885C6FDE74D9D06F3965E333CB4068504A8C5659E2A3860327C328A74A3C5F3EE4FC8C9FE39CC584BA5AE1458
                                        Malicious:false
                                        Preview:import copy.from typing import TYPE_CHECKING..from PyQt5.QtWidgets import (QDialog, QLineEdit, QTextEdit, QVBoxLayout, QLabel,. QWidget, QHBoxLayout, QComboBox)..from btchip.btchip import BTChipException..from electrum.gui.qt.util import PasswordLineEdit..from electrum.i18n import _.from electrum import constants, bitcoin.from electrum.logging import get_logger..if TYPE_CHECKING:. from .ledger import Ledger_Client..._logger = get_logger(__name__)...DEBUG = False..helpTxt = [_("Your Ledger Wallet wants to tell you a one-time PIN code.<br><br>" \. "For best security you should unplug your device, open a text editor on another computer, " \. "put your cursor into it, and plug your device into that computer. " \. "It will output a summary of the transaction being signed and a one-time PIN.<br><br>" \. "Verify the transaction summary and type the PIN code here.<br><br>" \. "Before pressing enter, plug the

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\ledger\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):398
                                        Entropy (8bit):4.436105371577658
                                        Encrypted:false
                                        SSDEEP:12:1KM82Zaw+85vz2Hvsb/aCTATSvehahBNA099a/:1/UP+qHvsb/aC9sahfA0y/
                                        MD5:6AFC46764F78CB549913211C932ABF9E
                                        SHA1:AD5BBE48D36EB947D6D3BFAF629A407D8DEF8E53
                                        SHA-256:F8860C9DE94C9E8058DA2B03755AE236BC0574BE21510B05B600F085CAFA5A1C
                                        SHA-512:BC559EA11527864E6B9E02E3AFE93B74ED6359E2EA5558153DC5F3A3A153F1BFAD4E265242B85EF409CC7838FAF41ACFC433ABF088D0E876098CA2DDF7BE46C8
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from .ledger import LedgerPlugin.from ..hw_wallet import CmdLineHandler..class Plugin(LedgerPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\ledger\ledger.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):60739
                                        Entropy (8bit):4.547634742971814
                                        Encrypted:false
                                        SSDEEP:384:5ud/kX6YVXmoY1UlHh2cRSOJL8rORuX/kkfShCMUlRUWaMjVuSkKKrbeANAeYc19:5udI6YVXmyHDI6d8UW7pwdF0Chfr
                                        MD5:09FDFBFA65B3413360649253DFF7F224
                                        SHA1:048E41B2555C8630A7A9AD5AC0AE2DAEA0F13C35
                                        SHA-256:4FF95014814EEF52F85EC80E45F36E311CCEAF55F584E6E7162C0F50CE5E748B
                                        SHA-512:098C6E5EF2D0C78B3BAC4FF9D18F8D8B900FF03D3A012D6C9E94023C1663B8C6573BD6F8FD63634459180BA3BE915D20C10DA7D55095A8E14FA3F4A5F494A539
                                        Malicious:false
                                        Preview:# Some parts of this code are adapted from bitcoin-core/HWI:.# https://github.com/bitcoin-core/HWI/blob/e731395bde13362950e9f13e01689c475545e4dc/hwilib/devices/ledger.py..from abc import ABC, abstractmethod.import base64.import hashlib.from typing import Dict, List, Optional, Sequence, Tuple, TYPE_CHECKING..from electrum import bip32, constants, ecc.from electrum import descriptor.from electrum.bip32 import BIP32Node, convert_bip32_intpath_to_strpath, normalize_bip32_derivation.from electrum.bitcoin import EncodeBase58Check, int_to_hex, is_b58_address, is_segwit_script_type, var_int.from electrum.crypto import hash_160.from electrum.i18n import _.from electrum.keystore import Hardware_KeyStore.from electrum.logging import get_logger.from electrum.plugin import Device, runs_in_hwd_thread.from electrum.transaction import PartialTransaction, Transaction, PartialTxInput.from electrum.util import bfh, UserFacingException, versiontuple.from electrum.wallet import Standard_Wallet..from ..hw_w

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\ledger\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3240
                                        Entropy (8bit):4.769142883833306
                                        Encrypted:false
                                        SSDEEP:96:CmW40QjLE0UxyM6+CnCtO2eVqQjt9O6JGEY:CrHi3UgMvJhWc
                                        MD5:7E6BB8599322D1619385865EAD965C95
                                        SHA1:B465F07EC88F2DF316EADC726EFC4E151C30F926
                                        SHA-256:7B18956F7F0473E84373DF390A391BE2DF2059173AF6EBC16513FE67B4A2AFB0
                                        SHA-512:49E806AC5BA2F25A183192FD8F2A612E57537A58D3EED458C8A5DA30F3AFB42C735B360654282B3362B9219314CF46605F0918C41968F63DB9BE5A5C27BA22CA
                                        Malicious:false
                                        Preview:from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import pyqtSignal.from PyQt5.QtWidgets import QInputDialog, QLineEdit..from electrum.i18n import _.from electrum.plugin import hook.from electrum.wallet import Standard_Wallet..from .ledger import LedgerPlugin, Ledger_Client.from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available.from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWUninitialized, WCHWUnlock, WCHWXPub..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard...class Plugin(LedgerPlugin, QtPluginBase):. icon_unpaired = "ledger_unpaired.png". icon_paired = "ledger.png".. def create_handler(self, window):. return Ledger_Handler(window).. @only_hook_if_libraries_available. @hook. def receive_menu(self, menu, addrs, wallet):. if type(wallet) is not Standard_Wallet:. return. keystore = wallet.g

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):140
                                        Entropy (8bit):4.653892747944294
                                        Encrypted:false
                                        SSDEEP:3:1ApxQ2MUdLNQK0rbF6qnXMSMZnNbt/8XqXAXMNFVHv66JfWyECbCin:1YvQ7rhC/FFttAcXh3Vrmin
                                        MD5:11E1D2BC564933B59B4619773B50851A
                                        SHA1:76BBB12A3CE6C9A0B5218D91F55AAC0C4FC55021
                                        SHA-256:2C0D9A443E5507125519D120B83E1D8FFA9E11AC4419F42B1658C1F589061D2B
                                        SHA-512:A5AABA08FF268EAB6A87A5A587D28F4DB48062FBF2AE730C87594DD76C4DE703878FFBE340E584C59B7924586004EB242EDCC34F0170F6AD592A53811C37D5BB
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = _('PayServer').description = 'run a HTTP server for receiving payments'.available_for = ['cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1253
                                        Entropy (8bit):5.155149269351112
                                        Encrypted:false
                                        SSDEEP:24:Uobk4JHWWV0yPP3VtkHe1oai9QHlsUjH8Ok46+d5Eo3DqeFUO:UEtJdVlPvLTmawQHlsyHIO5d3D1FZ
                                        MD5:933102C0C6E3280EA5E125F7E91CD578
                                        SHA1:3C369B1F4431537C05AD22D11CC605A3FB46448E
                                        SHA-256:298CD766F61C90F233EF52FFF9BFF848894DE13A088CE856E4E47036F931FEDC
                                        SHA-512:977BBBAB4C327D4BAD43579BD37D91235779C0919C83F215A1C83906AF7C601074510279261D1ED3A437A5D2FDB5160DF6A9B4FCD7D8762F636931A061A3AFC5
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2022 The Electrum Developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LI

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\payserver.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):6788
                                        Entropy (8bit):4.888160709542598
                                        Encrypted:false
                                        SSDEEP:192:hdwQHdFAfunGGKumBmpbUCmwNbDo7U7D7vG8:soyuBKumBmpbUCmwbDeU7/l
                                        MD5:309E5652E49734690D5958DE50680649
                                        SHA1:752C61C641A377074887EF5747FDD8C56D0EEDF2
                                        SHA-256:BDF81D7311BBAA677BF0692A5C9BDA0B367F3D3FEC1493254EF822DDCA8EF5DE
                                        SHA-512:31B173822BCCECCA143D144F297691F91A2ACCFAD2EAB6257913F34CAA2799CCD8FA3887784EA8FA0C49C854B3EE1668BBDB6C01BE660432BE0169B4C571F494
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2022 The Electrum Developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LI

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\.editorconfig

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):189
                                        Entropy (8bit):4.603023009803555
                                        Encrypted:false
                                        SSDEEP:3:SMRVYG62mQDMOXKL1vEBALcWj2xJ6PC2o/PgdvS+xFoqq45uIaucWepMik/rJbiZ:SQVYCmQCL1vE2L6Tmw/PiqegavJiedOZ
                                        MD5:57EE98C14EC81A9135983C3E84E8BDDD
                                        SHA1:715BAD219BE2F9D65F82D5914CD9BBE09CF543E4
                                        SHA-256:558BBCF2F0052713B6E479F4EF664E6D5ADBB31F006E42427468670682CDE2FF
                                        SHA-512:EBBC49967798528CEA50663925C5BF536226A213D98122DE8357746A2B6056C4D7E2A48ED97C9E0A6B09C6D9D5674E807BBB0603B4165BBB05AB5ED70ADED1D8
                                        Malicious:false
                                        Preview:# see https://EditorConfig.org..root = true..[*].indent_style = space.trim_trailing_whitespace = true.end_of_line = lf.charset = utf-8..[*.html].indent_size = 4.insert_final_newline = true.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\.git

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):46
                                        Entropy (8bit):3.801815010925754
                                        Encrypted:false
                                        SSDEEP:3:vW5yVC2gtmsAGxQ3hcn:vuteJhcn
                                        MD5:DA9726D60EE6D0B3FFE8FE7E7FFDD02E
                                        SHA1:926DB90A6B37528252D68254EBDA6D4439429192
                                        SHA-256:05A0DB3D8D302F2CB18FDE3FBEBDFC84233AEA1118ED4FFCFE6349A1BB817C53
                                        SHA-512:8AD688712BE8128C9DF39B824666F9987107B6F99F5F701FCE112651463A60DDF1F0230D2285098F8B4BD795EE12DEA010434EE665091F87A849BB6713D7370E
                                        Malicious:false
                                        Preview:gitdir: ../../../../.git/modules/electrum/www.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\.gitignore

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):6
                                        Entropy (8bit):2.584962500721156
                                        Encrypted:false
                                        SSDEEP:3:M5n:M5n
                                        MD5:7A8B085DBF273DE1BB2CB0B44C858F33
                                        SHA1:B9C4D3CFCF0530FA5EE6EACF43499BE4B0FD0505
                                        SHA-256:1D15BDB66E2D42CD0ECDDEB6926D7A97DBF7A82A055067B7B9AFC05112EE0437
                                        SHA-512:D295737DD931415A0071E117C076CA606D9DDCB5760DE461B6FE2C8B884618C68F79B130FBABBA9D53E12B8132422BCCBFFFF014B4CFB4D943A00BF65D9BF229
                                        Malicious:false
                                        Preview:.idea.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\LICENCE

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):1156
                                        Entropy (8bit):5.135419459723763
                                        Encrypted:false
                                        SSDEEP:24:TN90gMHiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:rQHiJzfPvGt7ICQH+sfIte36AFD
                                        MD5:6F575409890FC5018003C9DE6F701BB3
                                        SHA1:0E07954FD102EF9D14141BF3932D97F0CFFD9CAC
                                        SHA-256:7E74F53B0182E34D6DBAD47308F8719E947D7A8C4AEF8CBAB35C34B46BA9DF01
                                        SHA-512:0AC8598C3960D7F4221F21546B9EBE45BEA4369A9C84A56FDE7179A56D523AAF45F5903AC5B2353C394A656A83B6221920C088AF65DEAF3EB739F425FE940C8B
                                        Malicious:false
                                        Preview:MIT license (as below), except for the "vendor/" library...-----..The MIT License (MIT)..Copyright (c) 2022 The Electrum developers..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\README.md

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):63
                                        Entropy (8bit):4.277638551759855
                                        Encrypted:false
                                        SSDEEP:3:SstXQ1HvPET/V+LzD0FQJpjRo:SE6Hv8T/V+PD0SbjRo
                                        MD5:7AB347B2A1BB62AA469491E5A3ED02CC
                                        SHA1:5BD896B048174A63E9BE6EE2875A676AE381C309
                                        SHA-256:7CB581F049BD841F91277080976DD973D5781E82F0C7E823FF412BCCFB87022E
                                        SHA-512:CC470C5AD4541F33AB75BE3ACD47FDF7F37FF7E2EB8AA976A7E96A637457F2330428D151E82F428DEE06C5E163AE3464805484032F58338DA0AEDB917CD2AFDD
                                        Malicious:false
                                        Preview:# electrum-http.javascript and html files for payment requests.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\create_invoice.html

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:HTML document, ASCII text
                                        Category:dropped
                                        Size (bytes):1042
                                        Entropy (8bit):4.711894685746978
                                        Encrypted:false
                                        SSDEEP:24:0peYbM78V8EtpWTQzJ0OEhxuBeWsb8np/gT2IA:0TMQV8ipWE0JhAABbQpIy
                                        MD5:362F55B495A98401872518F374786FE5
                                        SHA1:8B22154EC5105D67836BFF52CE1B2DAFD060C1A0
                                        SHA-256:148C5C6C7A22704D789E3DD90AE6A722EDD14485744AE11DC6BDD04A3AC3781A
                                        SHA-512:F9395336914517E21B60544AC7DC086B6BD978FAE3B72BB93B95CF6752F0487DBEBBC3D6C38E09BFBE8B250C4B77034A2CE05441383874AB0659D4892C06D898
                                        Malicious:false
                                        Preview:<!doctype html>.<html>. <head>. <meta charset="utf-8">. <style type="text/css">. body {.. font-family: Arial;. }. form {. }. input {.. border: 2px solid #ccc;.. padding: 12px 20px;. }. </style>. </head>. <body>. <div style="width:30em; margin:auto;">. <p>This is a sample web interface that lets you create on-chain..and lightning invoices to your Electrum wallet. You can use it..with an electrum daemon running on a webserver. The lightning..invoice will be replaced by an error message if your wallet is..disconnected or does not have enough inbound liquidity to..receive the requested amount. The on-chain invoice will not be..displayed if the amount is too small to be received onchain.. </p>. <form method=POST action=/api/create_invoice>..<input name="message" placeholder="description"><br/>..<input type="number" min="1" name="amount_sat" placeholder="amount (satoshis)" ><br/>..<input type="submit" value="Create invoice"><br/>.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\index.html

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:HTML document, ASCII text
                                        Category:dropped
                                        Size (bytes):9691
                                        Entropy (8bit):4.975123909216841
                                        Encrypted:false
                                        SSDEEP:192:uaxDvaDsTawIOxkJsyrbzzpk5NnIJqtPB0UQKL85P6h9GfU9z8yVQ:zLSQyrbX7JqtPiA9Mj
                                        MD5:1681BAE57A7EC0694F7531CF27B17A81
                                        SHA1:4D2F49C78659BC2D8FC20260D8880C1A4E896B16
                                        SHA-256:5DCD17868ECF8FAD6A233305B67889FE8B9F8509947D082A392AB092E0D0C3FC
                                        SHA-512:1D39D107796D61F87E8D69700310F18E7D9018303AFD5BDA85A12A7BC5F2C802C3F97778F2F72AD52264076F240EDCF78C62A0D4EBB32AD7A1834AC4EB378EED
                                        Malicious:false
                                        Preview:<!DOCTYPE HTML>.<html>.<head>. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>. <title>Payment request</title>. <script type="text/javascript" charset="utf-8" src="vendor/jquery-3.4.1.min.js"></script>. <script type="text/javascript" src="vendor/jquery-ui.min.js"></script>. <script type="text/javascript" src="vendor/qrcode.js"></script>. <link rel="stylesheet" type="text/css". href="vendor/jquery-ui-themes-1.12.1/themes/ui-lightness/jquery-ui.css">. <style type="text/css">.. body {.. font-family: Arial;. }.. .tab {.. overflow: hidden;.. border: 1px solid #ccc;.. background-color: #f1f1f1;. }. .tab button {.. background-color: inherit;.. float: left;.. border: none;.. outline: none;.. cursor: pointer;.. padding: 14px 16px;.. transition: 0.3s;. }. .tab button:hover {.. background-color: #ddd;. }. .tab button.active {.. background-color: #ccc;. }. .tabcontent {.. display

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\pay

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:HTML document, ASCII text
                                        Category:dropped
                                        Size (bytes):9691
                                        Entropy (8bit):4.975123909216841
                                        Encrypted:false
                                        SSDEEP:192:uaxDvaDsTawIOxkJsyrbzzpk5NnIJqtPB0UQKL85P6h9GfU9z8yVQ:zLSQyrbX7JqtPiA9Mj
                                        MD5:1681BAE57A7EC0694F7531CF27B17A81
                                        SHA1:4D2F49C78659BC2D8FC20260D8880C1A4E896B16
                                        SHA-256:5DCD17868ECF8FAD6A233305B67889FE8B9F8509947D082A392AB092E0D0C3FC
                                        SHA-512:1D39D107796D61F87E8D69700310F18E7D9018303AFD5BDA85A12A7BC5F2C802C3F97778F2F72AD52264076F240EDCF78C62A0D4EBB32AD7A1834AC4EB378EED
                                        Malicious:false
                                        Preview:<!DOCTYPE HTML>.<html>.<head>. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>. <title>Payment request</title>. <script type="text/javascript" charset="utf-8" src="vendor/jquery-3.4.1.min.js"></script>. <script type="text/javascript" src="vendor/jquery-ui.min.js"></script>. <script type="text/javascript" src="vendor/qrcode.js"></script>. <link rel="stylesheet" type="text/css". href="vendor/jquery-ui-themes-1.12.1/themes/ui-lightness/jquery-ui.css">. <style type="text/css">.. body {.. font-family: Arial;. }.. .tab {.. overflow: hidden;.. border: 1px solid #ccc;.. background-color: #f1f1f1;. }. .tab button {.. background-color: inherit;.. float: left;.. border: none;.. outline: none;.. cursor: pointer;.. padding: 14px 16px;.. transition: 0.3s;. }. .tab button:hover {.. background-color: #ddd;. }. .tab button.active {.. background-color: #ccc;. }. .tabcontent {.. display

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-3.4.1.min.js

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (65451)
                                        Category:dropped
                                        Size (bytes):88145
                                        Entropy (8bit):5.291106244832159
                                        Encrypted:false
                                        SSDEEP:1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe
                                        MD5:220AFD743D9E9643852E31A135A9F3AE
                                        SHA1:88523924351BAC0B5D560FE0C5781E2556E7693D
                                        SHA-256:0925E8AD7BD971391A8B1E98BE8E87A6971919EB5B60C196485941C3C1DF089A
                                        SHA-512:6E722FCE1E8553BE592B1A741972C7F5B7B0CDAFCE230E9D2D587D20283482881C96660682E4095A5F14DF45A96EC193A9B222030C53B1B7BBE8312B2EAE440D
                                        Malicious:false
                                        Preview:/*! jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],E=C.document,r=Object.getPrototypeOf,s=t.slice,g=t.concat,u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?n[o.call(e)]||"object":typeof e}var

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\AUTHORS.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):12660
                                        Entropy (8bit):5.007082424862998
                                        Encrypted:false
                                        SSDEEP:192:CPi9lWCZ2RTCMfvMQAFYw7TFUAcj7uQNtpNA4tDTzrozIwm2vt31YmZ:VaZFkQSf7TFUAuA4c0wm213p
                                        MD5:403511FC6C430EA6179EBCB4A9983EEC
                                        SHA1:131842146D2B11D742A638F42739D7E0741DC026
                                        SHA-256:5B62E1D666C6A373B0734A175FD535F9315549961A0BBD8ABD246BAD1A775082
                                        SHA-512:97BADB94E8028918DB9EA30E3E038C4740941AA2C1BA284CCBC39A26157F771243CFC249F855228DE6DA3B7F7427B2ACD259318C6878F77529EB355762C15284
                                        Malicious:false
                                        Preview:Authors ordered by first contribution.A list of current team members is available at http://jqueryui.com/about..Paul Bakaus <paul.bakaus@gmail.com>.Richard Worth <rdworth@gmail.com>.Yehuda Katz <wycats@gmail.com>.Sean Catchpole <sean@sunsean.com>.John Resig <jeresig@gmail.com>.Tane Piper <piper.tane@gmail.com>.Dmitri Gaskin <dmitrig01@gmail.com>.Klaus Hartl <klaus.hartl@gmail.com>.Stefan Petre <stefan.petre@gmail.com>.Gilles van den Hoven <gilles@webunity.nl>.Micheil Bryan Smith <micheil@brandedcode.com>.J.rn Zaefferer <joern.zaefferer@gmail.com>.Marc Grabanski <m@marcgrabanski.com>.Keith Wood <kbwood@iinet.com.au>.Brandon Aaron <brandon.aaron@gmail.com>.Scott Gonz.lez <scott.gonzalez@gmail.com>.Eduardo Lundgren <eduardolundgren@gmail.com>.Aaron Eisenberger <aaronchi@gmail.com>.Joan Piedra <theneojp@gmail.com>.Bruno Basto <b.basto@gmail.com>.Remy Sharp <remy@leftlogic.com>.Bohdan Ganicky <bohdan.ganicky@gmail.com>.David Bolter <david.bolter@gmail.com>.Chi Cheng <cloudream@gmail.com>.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\LICENSE.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):1817
                                        Entropy (8bit):5.104115525869163
                                        Encrypted:false
                                        SSDEEP:48:UzHtub9kugsniJzfPvGt7ICQH+sfIte36AFdMhw+dEXt4V:uHtyyu2Put0CQHT6fhw+dEXeV
                                        MD5:E0C0D3D883E83F19EFA64FEB54D5F63D
                                        SHA1:15DF6665DFD90F5CD8FDFDE4C0C43051FBB76DAE
                                        SHA-256:DE33FB695880D0B07615D4B86F78CD43796906959ADE5FDFEF70968827A0DB78
                                        SHA-512:9D6477C8BC412206AE4258CB5D260AEDB593F5830F9B539F4A744BB6B9FEA35A1D36D3D82A5731EAE36FFBA1671705EE0CEA499320CC450D74B4F7A2898FA3AD
                                        Malicious:false
                                        Preview:Copyright jQuery Foundation and other contributors, https://jquery.org/..This software consists of voluntary contributions made by many.individuals. For exact contribution history, see the revision history.available at https://github.com/jquery/jquery-ui..The following license applies to all parts of this software except as.documented below:..====..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INC

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_444444_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.919659124224948
                                        Encrypted:false
                                        SSDEEP:192:d0qa5wogj5iPmijz0onp6MYOF6zv/pw5a6a6kIBOI:za5U5yHp6XqCvB96aqOI
                                        MD5:79B89CC07096D272B27EDEFCCE2DA120
                                        SHA1:B19FF112C585040AEDEA7F24BD6A49D611564267
                                        SHA-256:C1D0EE16F6D7056117904C782C1CB6294D1506604F34B77C8B4237672C676DC9
                                        SHA-512:29F81723F15D7164537198C3E8F94366ECFF50D1987B3E5C17B058D82BAD6ABCFF35716C3529D53D0DA05DEAA95E1E55A4F684D4B5B4C482337798FEEFF01BB0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.D.<......tIME......6..F....IDATx..k.%Gu..m;....!.^.....l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S....d.5..x..^.../.2........,..+M..^....O..r..`.:..S.|.{.Y...`...`k?..a...6...1...@..5..S.#.Gd......).q.vX.u.B@.*.J@`H.N...A....1n.:.P..,D:A..q+.=...f.]S..q.!.....+Lm.>|...XhN.^.4.A...3C...J.....`Z.U.=.s.4.....)...-...`F8.i.RY..CP.....C.Z..:...{....p......@........px.h8..4.^...o...;..o2....Y..1m.=...v......E.GJH....i..U.g.>.k.6..R_.}.S..k..=..~5<.e..........n.oF......d{...U.^@...>]..L..-oz.....e..%PE.dR...=.I.l.O\r..6`.S..`...dxup....../........@........px.h8..t.....W.....9........... {...\..B0..]....(eQ........T..Q5.[.\B..{...V.......C...!4({\...h.w.g..{..Kh.....l.X..v.p-..Z.^IA.:......ur.&..%5.t.S...Ch...NKgn..\.Pv..:..[(......8.nb.K.Uk...]..A.^.50..\B.i......4l].[.mkA...L"....v...2=.[.Yo..8.2..c`.`

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_555555_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7074
                                        Entropy (8bit):7.928012384219511
                                        Encrypted:false
                                        SSDEEP:96:gMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6KaP:zXTvYXQzy51nfmcuXibSralG/aP
                                        MD5:00DD0EC0A16A1085E714C7906FF8FB06
                                        SHA1:244BD9B7C3B1C4F7EF72DE31F67804FAFF213715
                                        SHA-256:5D04051DFD9D2D740355404F98A683D1EC0FEB2FCA7D76E533C1A6E5CE92DD2E
                                        SHA-512:163AFECE9AE9693C41324FFD89191132A8D2E42D73F962ACE0B70B44A17D954C8F506CC25AF152397E2536DA6245E4336AE465708EDF6EDE955B4AD502AF7A71
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.U...I....tIME......6..F....IDATx..{.$G}.?m;....!.>...l.....G$,..&.%.|.........].]..=...?ptg..Y.G.. ...b...'....8$.f..;.#...A..G......3;...=..L..........W.^<................&.=.Ll&<.D.Y.V.D.^.`..O..r..`.:.$)...=.L.s....L.=?..a|..6...I#V+A...1.L).P.!......)$q..<....U`....r.2...t. )b....B.zDD....'O....{.5....[.Y.`..]az...GtwS..S..l.. 1.z..!(..h~.L.`V.U..{..g.ws...l.g......p.U.f.2..CP.....C...[.mVF.y...h8.J`....px.4.....'@....px.4... .w...d...p...)c.F{.....S.......>R$)g...3W....i...mk~[.+.O}.#c.P...._.OB..mz.-..=.)w.....i'.#...@.].S/..c.>]..L.[.......e.%PE.dR...=..\..').W..0..k.0..o2.:....A..'@....px.4.....'@....p.3........._+-..s.E.K%.2..5..UA...(.<..`......+H..=l...>0.b'G..n%p.U".YR.[..........R...q._`....H.5`...@.%6..b)....Z|.......t.Q.i.E.. Lc.J.xw.]..K... 7...........$0txzl.\.Y..wk..!uS...[..L..K..:(...f].K(......lN...u.'.vw.IdU.)n.K9(...u..f..c/.<....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_777620_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.766413362618199
                                        Encrypted:false
                                        SSDEEP:96:7sHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:oHm231Nvu+wIqltWOe3nIH
                                        MD5:4E7E3E142F3939883CD0A7E00CABDAEF
                                        SHA1:D20567FD436991539EAFD65C3BDE77D82A656012
                                        SHA-256:9DBE4A0D03FEED6F65EB2560A0A8B4BA4264545EE8FD31C1763A3B219D0328D6
                                        SHA-512:D145A64F637F34D9F9FEFAF7CEF14EA277D0933E16C625234A9C1E0A54A7F3D0D820AB49B4B68D5D3E9853399D74EFBA9FF7771BFD3481F8C1C70E6DC6F50275
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEwv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv .......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME......6..F....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_777777_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7111
                                        Entropy (8bit):7.919098640897273
                                        Encrypted:false
                                        SSDEEP:192:3ZL/Hq8z/FyEJ3kJpSiztKi4NkaerdCVHMh:x/HqpEJ3KpSiJKvNSrdCVHM
                                        MD5:FEF4DC5A79A6117235D7ED374987A212
                                        SHA1:690D30967A468B399320549E7D04F47E2E7F2E52
                                        SHA-256:D5CBF092012C0710EA36A3A1C51072DABF7714AECE783A6D8B010396427E879C
                                        SHA-512:07C5F904D0C2AEE27337753B4F038CCEFAEA5DED66D3C84B7352BEC6408D3D128A8BF1C5F0B3E9E72832CEFF5D5A395261F1E86C04160BAB99558E679E2D6972
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.wd......tIME......6..F....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>...........h2..t.<../......mB...f....6+.J.D...0...&..s..N...._..B..s....&..>~.?...c{v..j%.....)...#D..E...F.I...G..........R.S.C...$EL..!..GD.NP)~..t.=;..w.me.B.z.s...S......M,4.R.m.. 1.z..!(..hnE.6.Uj.cO..6.y7..Y.~fK..1l..WM....*..+p.....G..Uz..F..Qb..^......px.h8..4.^.../........@.....q...MF.{.7...2.m..0?..:..vux.....r..n.0s....Os.....Wr...G...h..A....2...t[l.{.S..O..7#..N.G..=..Z.S/..co.......7...Vk.2O.....j.blc.l.`..[...<.%}a.......x...t.7.^..p......@........px.h8..4.^.....CF...W.....9........... {...\..B0..]....(eQ....G......jl....*..,)....C......r)BhP.../0...r.H(..0..,@.%6.....q.p-..Z.^IA.:......ur....%U|..)I...!4..ig.37.1...........E:..q7.......n..05A...uP..y..8.Pj....K.9.[...E.Z............L...u.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_cc0000_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.702209367432273
                                        Encrypted:false
                                        SSDEEP:96:NsHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:6Hm231Nvu+wIqltWOe3nIH
                                        MD5:2077B5EAB79CBBC34DC270E93BF36BBC
                                        SHA1:296E7BC1A8528A7BFCEF17B4CD727D80285DEE50
                                        SHA-256:B54DCE3082F3377765C041F959A72007702AB54457DA21A20DFB15BAF9740954
                                        SHA-512:270AFFA25147BAE0713566E37D4B477C486DC77F4BFB8A239889BF3F31C073A402145345DDB8186D415838735852CC6F11567EA22F3497E496B1A903693F1774
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................xS....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME......6..F....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.9034761541412495
                                        Encrypted:false
                                        SSDEEP:192:Sj0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxhi:SIgz9tEOJ4bKAPmZvqAbi
                                        MD5:A90930462F29CF706358262D88F1B626
                                        SHA1:C8B7178EB17C36A1DF4CA5BADF2A85834436FE9F
                                        SHA-256:F93D2A7069B40745FD01E364ED57771BECFEBD8868BB9130220A47E0ABFF9C49
                                        SHA-512:94775B3EC8843A93AB54E663E4E06728D6C2FD1E792802D8C5CCBDFFF96673F5B993039E1C65D178247CA2F21326F8D455B81425249663B54A1AAE59A423CA35
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME......6..F...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2515)
                                        Category:dropped
                                        Size (bytes):37326
                                        Entropy (8bit):5.311560606113339
                                        Encrypted:false
                                        SSDEEP:192:10OW0dCbMiEt7b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHz:pCwiEt7b/+vaW1e07PPiF5fy/EzDS25A
                                        MD5:6FD5A6E8197041971D02CF62D06F4B14
                                        SHA1:9997BEC65F4FFFD3CA7178E14F67B8CD6AD1A9C7
                                        SHA-256:A7AC54F58BA507B13621CEB6FCF5FE879F5AC9BDCF049D16153110C6AD048C7C
                                        SHA-512:BABA481707CB23D6432FCD6CE9E26380117B2E91BE44E5E3A75A0DC138F8812942C34D0A895D6B581ADFB33577B9FE6BFAFEB6D5FB00C2ABF2D7044979E593FC
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgContentXPos=&bgHeaderXPos=&bgActiveXPos=&bgHoverXPos=&bgDefaultXPos=&bgShadowYPos=&bgOverlayYPos=&bgErrorYPos=&bgHighlightYPos=&bgContentYPos=&bgHeaderYPos=&bgActiveYPos=&bgHoverYPos=&bgDefaultYPos=&bgShadowRepeat=&bgOverlayRepeat=&bgErrorRepeat=&bgHighlightRepeat=&bgContentRepeat=&bgHeaderRepeat=&bgActiveRepeat=&bgHoverRepeat=&bgDefaultRepeat=&iconsHover=url(%22images%2Fui-icons_555555_256x240.png%22)&iconsHighlight=url(%22images%2Fui-icons_777620_256x240.png%22)&iconsHeader=url(%22images%2Fui-icons_444444_25

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29137)
                                        Category:dropped
                                        Size (bytes):32076
                                        Entropy (8bit):5.255171404355352
                                        Encrypted:false
                                        SSDEEP:384:pCwiEt7lcR8lOXHc11evBMzymUh+4C6G/zDcSc7nfZBhVi:slEtiXHcEBMznURC6G/zD8BhA
                                        MD5:0B5729A931D113BE34B6FAC13BCF5B29
                                        SHA1:88BA90D2D2944315AFD28A706EE5715ED980C634
                                        SHA-256:AC1C8F94750B39B12327A5D0C56FDF946DABFB6D91E5D2A202879FF9A5D67E29
                                        SHA-512:68E1B473A9CF3731A4FB9CE3C3225AA1152009D3AB7D20E198C203DAEE3E388B25AF41A3A4B2A8ED79B4028DF19A93384FC026228B9192AC23D67ADD56C2CA11
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgContentXPos=&bgHeaderXPos=&bgActiveXPos=&bgHoverXPos=&bgDefaultXPos=&bgShadowYPos=&bgOverlayYPos=&bgErrorYPos=&bgHighlightYPos=&bgContentYPos=&bgHeaderYPos=&bgActiveYPos=&bgHoverYPos=&bgDefaultYPos=&bgShadowRepeat=&bgOverlayRepeat=&bgErrorRepeat=&bgHighlightRepeat=&bgContentRepeat=&bgHeaderRepeat=&bgActiveRepeat=&bgHoverRepeat=&bgDefaultRepeat=&iconsHover=url(%22images%2Fui-icons_555555_256x240.png%22)&iconsHighlight=url(%22images%2Fui-icons_777620_256x240.png%22)&iconsHeader=url(%22images%2Fui-icons_444444_25

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.structure.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):18705
                                        Entropy (8bit):5.342686576013018
                                        Encrypted:false
                                        SSDEEP:192:XW6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHL:XW/+vaW1e07D
                                        MD5:B75D9919DED1B610C51A4727DD4B9720
                                        SHA1:3C2C0061EEAFC1D3C0D8663481BEE315D38C5A5D
                                        SHA-256:135BAA57E778D769DB488FA8A8330842C4D2B6D3FE152EC1C7073B99075060EA
                                        SHA-512:72A4961E118A4D30F6BC7CB700520EEC3520C7BB680C9DE15CF9C9744E02ED81B34DE8E7B58F62675C5BEC6AB24F1CA1CC95AC10AF09A620335B6F4566AB04DD
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. */./* Layout helpers.----------------------------------*/..ui-helper-hidden {..display: none;.}..ui-helper-hidden-accessible {..border: 0;..clip: rect(0 0 0 0);..height: 1px;..margin: -1px;..overflow: hidden;..padding: 0;..position: absolute;..width: 1px;.}..ui-helper-reset {..margin: 0;..padding: 0;..border: 0;..outline: 0;..line-height: 1.3;..text-decoration: none;..font-size: 100%;..list-style: none;.}..ui-helper-clearfix:before,..ui-helper-clearfix:after {..content: "";..display: table;..border-collapse: collapse;.}..ui-helper-clearfix:after {..clear: both;.}..ui-helper-zfix {..width: 100%;..height: 100%;..top: 0;..left: 0;..position: absolute;..opacity: 0;..filter:Alpha(Opacity=0); /* support: IE8 */.}...ui-front {..z-index: 100;.}.../* Interaction Cues.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.structure.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (15418)
                                        Category:dropped
                                        Size (bytes):15548
                                        Entropy (8bit):5.293143563287801
                                        Encrypted:false
                                        SSDEEP:192:ti4ncR8lOG1bRCNPbtqxlhIuxrjv572hk/k52bZuQEjQDMsrsUR9P:tlcR8lOXHc11evs
                                        MD5:5581D20AA5062ED5C0B6048F68E76055
                                        SHA1:CF0560924A39F484D334498D5811836E4EC28E28
                                        SHA-256:AF16A2B37EDA9CA527A4BE50CD262D7BE26722C9A41A62C6F9984A4A4664C153
                                        SHA-512:A0CDB860EB208F5C820C7C16F3DE59B4AEF3A03420B1C9F09022D770F50DB13470A16D53D670C8BB0919ABF3BAA0B623A6ECF80DF103AF4D8F82EBBAF2BE3FDF
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Copyright jQuery Foundation and other contributors; Licensed MIT */...ui-helper-hidden{display:none}.ui-helper-hidden-accessible{border:0;clip:rect(0 0 0 0);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px}.ui-helper-reset{margin:0;padding:0;border:0;outline:0;line-height:1.3;text-decoration:none;font-size:100%;list-style:none}.ui-helper-clearfix:before,.ui-helper-clearfix:after{content:"";display:table;border-collapse:collapse}.ui-helper-clearfix:after{clear:both}.ui-helper-zfix{width:100%;height:100%;top:0;left:0;position:absolute;opacity:0;filter:Alpha(Opacity=0)}.ui-front{z-index:100}.ui-state-disabled{cursor:default!important;pointer-events:none}.ui-icon{display:inline-block;vertical-align:middle;margin-top:-.25em;position:relative;text-indent:-99999px;overflow:hidden;background-repeat:no-repeat}.ui-widget-icon-block{left:50%;margin-left:-8px;display:block}.ui-widget-overlay{position:fixed;top

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2516)
                                        Category:dropped
                                        Size (bytes):18671
                                        Entropy (8bit):5.157579434617568
                                        Encrypted:false
                                        SSDEEP:192:X3CbMiEtzlPiF5fy/Ec4dDAwQ2gmB0iBfT9RhS2wV53skuMaaSQhQz0iIhp:X3CwiEtpPiF5fy/EzDS25A
                                        MD5:C4679DB4ADB3F9B8089213C6C396E2EE
                                        SHA1:BD9C7C141312CE373116F98B120594408C1A6707
                                        SHA-256:984303DF44D383EBC81065261C781C8123A09B41417CB8A9C90F7B26BD134C7F
                                        SHA-512:29DC56431FBBABA567F72FEF2A525ADC6CACAC64DCB3C3B7480BD5546869536881FCBBE5AD959EFBA6E5F7E04CD1E109548FDD52572C90CE6361BCFB6F984630
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgContentXPos=&bgHeaderXPos=&bgActiveXPos=&bgHoverXPos=&bgDefaultXPos=&bgShadowYPos=&bgOverlayYPos=&bgErrorYPos=&bgHighlightYPos=&bgContentYPos=&bgHeaderYPos=&bgActiveYPos=&bgHoverYPos=&bgDefaultYPos=&bgShadowRepeat=&bgOverlayRepeat=&bgErrorRepeat=&bgHighlightRepeat=&bgContentRepeat=&bgHeaderRepeat=&bgActiveRepeat=&bgHoverRepeat=&bgDefaultRepeat=&iconsHover=url(%22images%2Fui-icons_555555_256x240.png%22)&iconsHighlight=url(%22images%2Fui-icons_777620_256x240.png%22)&iconsHeader=url(%22images%2Fui-icons_444444_256x240.png%22)&iconsError=url(%22images%2Fui-icons_cc0000_256x240.png%22)&iconsDefault=url(%22images%2Fui-icons_777777_

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.theme.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (13719)
                                        Category:dropped
                                        Size (bytes):13849
                                        Entropy (8bit):4.869966761350074
                                        Encrypted:false
                                        SSDEEP:192:tgGIzlzymUh+4pQz6G3PRBGWLiXxBm9v5B6xBpYPzFhCNBjVs5y6sybYw9QoFYx4:trMzymUh+4C6G/zDcSc7nfZBhVi
                                        MD5:C12CAC44216CF877FD0C6903F3794407
                                        SHA1:A3640158B618410B280A5F37E54661A8337D6BD0
                                        SHA-256:023CA8C9A46D9C6553CB0287FC8B31C6EE4F5C8D2CE02704D01CCF017F373E97
                                        SHA-512:F61ED746551E53070751FF5B3625924CEF68BCE58510BC5395588FF34D5EE416F0349E62AFDB9AE8BDB4B44AE8599766F8714101604BC76A87E25E101C7951CA
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Copyright jQuery Foundation and other contributors; Licensed MIT */...ui-widget{font-family:Arial,Helvetica,sans-serif;font-size:1em}.ui-widget .ui-widget{font-size:1em}.ui-widget input,.ui-widget select,.ui-widget textarea,.ui-widget button{font-family:Arial,Helvetica,sans-serif;font-size:1em}.ui-widget.ui-widget-content{border:1px solid #c5c5c5}.ui-widget-content{border:1px solid #ddd;background:#fff;color:#333}.ui-widget-content a{color:#333}.ui-widget-header{border:1px solid #ddd;background:#e9e9e9;color:#333;font-weight:bold}.ui-widget-header a{color:#333}.ui-state-default,.ui-widget-content .ui-state-default,.ui-widget-header .ui-state-default,.ui-button,html .ui-button.ui-state-disabled:hover,html .ui-button.ui-state-disabled:active{border:1px solid #c5c5c5;background:#f6f6f6;font-weight:normal;color:#454545}.ui-state-default a,.ui-state-default a:link,.ui-state-default a:visited,a.ui-button,a:link.ui-button,a:visited.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_444444_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.920105159011246
                                        Encrypted:false
                                        SSDEEP:192:G0qa5wogj5iPmijz0onp6MYOF6zv/pw5a6a6kIBOo:ea5U5yHp6XqCvB96aqOo
                                        MD5:23B19953D6FF01805EBAC2A86924837B
                                        SHA1:CE3119A5D6AF1B50FF8D750DB706B6A3D5628796
                                        SHA-256:EB8DFEB98C17CA86564BC8B629D33DB66BFCB9D70B92E0718BEBFA9341E75607
                                        SHA-512:FD8772D61727CF266E18457F3C70499834EF9B0FB6C68A53762593827D72CAFD9D208741B6BF5C2CB9F8F6E97083B85BF9F81B339B8CBCA8BC251CE3DC335F69
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.D.<......tIME.....%...'E....IDATx..k.%Gu..m;....!.^.....l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S....d.5..x..^.../.2........,..+M..^....O..r..`.:..S.|.{.Y...`...`k?..a...6...1...@..5..S.#.Gd......).q.vX.u.B@.*.J@`H.N...A....1n.:.P..,D:A..q+.=...f.]S..q.!.....+Lm.>|...XhN.^.4.A...3C...J.....`Z.U.=.s.4.....)...-...`F8.i.RY..CP.....C.Z..:...{....p......@........px.h8..4.^...o...;..o2....Y..1m.=...v......E.GJH....i..U.g.>.k.6..R_.}.S..k..=..~5<.e..........n.oF......d{...U.^@...>]..L..-oz.....e..%PE.dR...=.I.l.O\r..6`.S..`...dxup....../........@........px.h8..t.....W.....9........... {...\..B0..]....(eQ........T..Q5.[.\B..{...V.......C...!4({\...h.w.g..{..Kh.....l.X..v.p-..Z.^IA.:......ur.&..%5.t.S...Ch...NKgn..\.Pv..:..[(......8.nb.K.Uk...]..A.^.50..\B.i......4l].[.mkA...L"....v...2=.[.Yo..8.2..c`.`

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_555555_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7074
                                        Entropy (8bit):7.928410973506381
                                        Encrypted:false
                                        SSDEEP:96:HbTMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6Ka3:8XTvYXQzy51nfmcuXibSralG/a3
                                        MD5:EEBB826ECD3EBE8C61B5EE9645879A2B
                                        SHA1:78B80151260D9A2722BE8D5C17AEB27EFF194C58
                                        SHA-256:A19D489F7769610F4AE20BBA35E81041BADADB8BC443D256D33EACECE74E909A
                                        SHA-512:DA08F4C488ED432661493233D3CA07E015EE39566CFE80360CC94B5EFCF1F28559BC2CB622466948DEC6E6A22ABBBE67EDEC7450FC24AC311CD19003675F44E1
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.U...I....tIME.....%...'E....IDATx..{.$G}.?m;....!.>...l.....G$,..&.%.|.........].]..=...?ptg..Y.G.. ...b...'....8$.f..;.#...A..G......3;...=..L..........W.^<................&.=.Ll&<.D.Y.V.D.^.`..O..r..`.:.$)...=.L.s....L.=?..a|..6...I#V+A...1.L).P.!......)$q..<....U`....r.2...t. )b....B.zDD....'O....{.5....[.Y.`..]az...GtwS..S..l.. 1.z..!(..h~.L.`V.U..{..g.ws...l.g......p.U.f.2..CP.....C...[.mVF.y...h8.J`....px.4.....'@....px.4... .w...d...p...)c.F{.....S.......>R$)g...3W....i...mk~[.+.O}.#c.P...._.OB..mz.-..=.)w.....i'.#...@.].S/..c.>]..L.[.......e.%PE.dR...=..\..').W..0..k.0..o2.:....A..'@....px.4.....'@....p.3........._+-..s.E.K%.2..5..UA...(.<..`......+H..=l...>0.b'G..n%p.U".YR.[..........R...q._`....H.5`...@.%6..b)....Z|.......t.Q.i.E.. Lc.J.xw.]..K... 7...........$0txzl.\.Y..wk..!uS...[..L..K..:(...f].K(......lN...u.'.vw.IdU.)n.K9(...u..f..c/.<....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_777620_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.766757991708586
                                        Encrypted:false
                                        SSDEEP:96:7NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:rHm231Nvu+wIqltWOe3nIP
                                        MD5:0F7BB232F0077013CFE3231B6D56F201
                                        SHA1:07183152ECF40C6F277B3DDD3A841C4F9F046611
                                        SHA-256:FE1AF6959B854C63CF101E6F51B8F15296A66A287FDF4B1283A3AF199D2294F7
                                        SHA-512:B29F864170DB2C7B21E2530D16C76757045A91173CFB8F1A99CCD214D2625F74C986D10A98A339B8E81D65757362876A9060EE9D3C2FAD994B8F61783866A615
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEwv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv .......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_777777_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7111
                                        Entropy (8bit):7.919277243804909
                                        Encrypted:false
                                        SSDEEP:192:+ZL/Hq8z/FyEJ3kJpSiztKi4NkaerdCVHMl:y/HqpEJ3KpSiJKvNSrdCVHM
                                        MD5:EE545339F50EAF87C6AC783B2C8D17E8
                                        SHA1:FD1AEC501E23B0A7A022DE638234C15316AA7D70
                                        SHA-256:04E0C4263C2829DC10E9E1E39E9D186F60775B7BBE5B15BCC0B33BE5B0E575EA
                                        SHA-512:BD889EA0D6EABB217C019D78A362B29D2575BFDDE5C4A403182052B9E198F59AA36091BD8267A474864717C01D0203225C6D29C1AB3CF086A87B93E40128A3EB
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.wd......tIME.....%...'E....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>...........h2..t.<../......mB...f....6+.J.D...0...&..s..N...._..B..s....&..>~.?...c{v..j%.....)...#D..E...F.I...G..........R.S.C...$EL..!..GD.NP)~..t.=;..w.me.B.z.s...S......M,4.R.m.. 1.z..!(..hnE.6.Uj.cO..6.y7..Y.~fK..1l..WM....*..+p.....G..Uz..F..Qb..^......px.h8..4.^.../........@.....q...MF.{.7...2.m..0?..:..vux.....r..n.0s....Os.....Wr...G...h..A....2...t[l.{.S..O..7#..N.G..=..Z.S/..co.......7...Vk.2O.....j.blc.l.`..[...<.%}a.......x...t.7.^..p......@........px.h8..4.^.....CF...W.....9........... {...\..B0..]....(eQ....G......jl....*..,)....C......r)BhP.../0...r.H(..0..,@.%6.....q.p-..Z.^IA.:......ur....%U|..)I...!4..ig.37.1...........E:..q7.......n..05A...uP..y..8.Pj....K.9.[...E.Z............L...u.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_cc0000_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.702553996522658
                                        Encrypted:false
                                        SSDEEP:96:NNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:dHm231Nvu+wIqltWOe3nIP
                                        MD5:43C9C3B95C08C992741D28AF12E36597
                                        SHA1:0F8640441757AC39626E42E6072B5E054F3523D9
                                        SHA-256:679FD5C7A9307B11B44F72140129D489B2CDA77C9001CCAE7FE7C564534FBA5B
                                        SHA-512:2D0BA16FAF9239D809E3C05C5561CA7F838CC013FB71357D83A1BC321B97D8DFF4F7F722E051767DD8336ABDE86DEF3BF569FE69FF485EDC959104F8F69080DC
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................xS....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):35973
                                        Entropy (8bit):5.266740217260602
                                        Encrypted:false
                                        SSDEEP:192:10OW02ANbMb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHllPb:xMb/+vaW1e07/PiF5fy/EzDS25qb
                                        MD5:C4A88EC0CB998929A670C0C58D7DC526
                                        SHA1:03135A88E8DBC36020DD453D1E7407CE9A3A2CC2
                                        SHA-256:44F8A56D427917B5FA0DD7933BA545679BE5E6B3B93099E64A4E29C2159F57C0
                                        SHA-512:FD0D6C06ABCD661796DB2BC071C2A2BBFC5CFE8D80B434B68CD068CC312A03FF0C93F21C1FCE77C2BC03486A80765EE317239639C79F2EDC03777918A36EFA1F
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=normal&cornerRadius=3px&bgColorHeader=e9e9e9&bgTextureHeader=flat&borderColorHeader=dddddd&fcHeader=333333&iconColorHeader=444444&bgColorContent=ffffff&bgTextureContent=flat&borderColorContent=dddddd&fcContent=333333&iconColorContent=444444&bgColorDefault=f6f6f6&bgTextureDefault=flat&borderColorDefault=c5c5c5&fcDefault=454545&iconColorDefault=777777&bgColorHover=ededed&bgTextureHover=flat&borderColorHover=cccccc&fcHover=2b2b2b&iconColorHover=555555&bgColorActive=007fff&bgTextureActive=flat&borderColorActiv

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29135)
                                        Category:dropped
                                        Size (bytes):30724
                                        Entropy (8bit):5.207927153668432
                                        Encrypted:false
                                        SSDEEP:384:xMlcR8lOXHc11evBMzymUh+4C6G/zDcSc7nfZBhVtQ:xHXHcEBMznURC6G/zD8BhY
                                        MD5:8DCEBF12FBABEA677390CFA6D9AD09FB
                                        SHA1:3765BA197944D25B3AEFE663300F0C74A6EEE792
                                        SHA-256:B0419FAF03242236E04C1C062D52B7F011BF5F0222342FC4006F51CEC7DD6BA0
                                        SHA-512:A24138A305C3D247D7CE05570730832224929695E7DED25B36876782C4E72183C95A3B9886D27EA8CA1CD3E594C0B1DE3B09ECD309B9ECA6BDD3716A40A335B0
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=normal&cornerRadius=3px&bgColorHeader=e9e9e9&bgTextureHeader=flat&borderColorHeader=dddddd&fcHeader=333333&iconColorHeader=444444&bgColorContent=ffffff&bgTextureContent=flat&borderColorContent=dddddd&fcContent=333333&iconColorContent=444444&bgColorDefault=f6f6f6&bgTextureDefault=flat&borderColorDefault=c5c5c5&fcDefault=454545&iconColorDefault=777777&bgColorHover=ededed&bgTextureHover=flat&borderColorHover=cccccc&fcHover=2b2b2b&iconColorHover=555555&bgColorActive=007fff&bgTextureActive=flat&borderColorActiv

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1166)
                                        Category:dropped
                                        Size (bytes):17319
                                        Entropy (8bit):5.050806478020723
                                        Encrypted:false
                                        SSDEEP:192:XcANb8lPiF5fy/Ec4dDAwQ2gmB0iBfT9RhS2wV53skuMaaSQhQz0iIhBb:XLCPiF5fy/EzDS25qb
                                        MD5:829DF24BE21885E09FA3E76156B47087
                                        SHA1:285600EDCD4B0CAFA3C82FC9C9A32310B7483B91
                                        SHA-256:6DE4F2D1B262787509F1D31EC58C9DE526A12833E0D10B6C2DD085F69AAFEC72
                                        SHA-512:0F3999088E42FB1F83F1AE4C037B25EF407A6FC078DFAC71C0B5F0B0A2CDF2BA97C6C0C3ABE92D73B3D26AFDC4A5AD95979A0E06E92C093CF1E8967685D7EDD2
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=normal&cornerRadius=3px&bgColorHeader=e9e9e9&bgTextureHeader=flat&borderColorHeader=dddddd&fcHeader=333333&iconColorHeader=444444&bgColorContent=ffffff&bgTextureContent=flat&borderColorContent=dddddd&fcContent=333333&iconColorContent=444444&bgColorDefault=f6f6f6&bgTextureDefault=flat&borderColorDefault=c5c5c5&fcDefault=454545&iconColorDefault=777777&bgColorHover=ededed&bgTextureHover=flat&borderColorHover=cccccc&fcHover=2b2b2b&iconColorHover=555555&bgColorActive=007fff&bgTextureActive=flat&borderColorActive=003eff&fcActive=ffffff&iconColorActive=ffffff&bgColorHighlight=fffa90&bgTextureHighlight=flat&borderColorHighlight=d

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_diagonals-thick_8_333333_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):383
                                        Entropy (8bit):6.418386094265965
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP0CUyKOkp4/ZGwZaar2s3pMcXRs0w8UvFkfxxzgN+E8VLEMlVbEbp:6v/7MCUUGhLSJQIZxzS+EELEMPS
                                        MD5:F9116832CBDC3F3EEE2DF7EB0F6A53B2
                                        SHA1:BDD7D30174D4AD3A2C2DE75293514C5B799AE7F8
                                        SHA-256:E118AF3DA06F5EF3A6AF384E50F1A84C63C7B4F4186E5F81D939DA5792FCF19F
                                        SHA-512:45C8553BD148FF24CBD55AAECD4D053D73B334AFC58EF3E7FAEA54B00095352E3DAA23ADFED7CA68D4465159CF2D9F676E361AAAD958E974587F12B61EB68A51
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDATH...1..0...g\z.."^.{.J]..Rj)".......h.[.S5%kH.5....\.)...'..I.v.\.(.W.....{.....@.. .I.r....c.....M6...c..$...\t...N.N.N.6....N..r_...5.j...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_glass_40_111111_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):323
                                        Entropy (8bit):5.943230772078117
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkp4/dM5auUVA6qhElyrn9e0xzgN+E8VLEMlVbEbp:6v/7JSU4M5DUQMyrn9XzS+EELEMPS
                                        MD5:D13BE7DB4996BEE314A57491201C8B58
                                        SHA1:4AFC6DE24265229B1CFA27C0DD3984C53F51C69C
                                        SHA-256:BAF8E63100F2F3FD4943853828A6E7D63516FFEDF475F91C6DE10FBF59306D7F
                                        SHA-512:D359FE3EB8DAF1E2F03E81355FA812C945512D0D681A49CF92990928F36756FBEED324C1D6BE1AFE5E841778D0C467E88A1957F4B074AF61643B185465E97189
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......KIDAT8.c0.ab`.E....AP.Ah"...&..L,.L...X.0..3..0.<`b...Z..........0...EC.......ko,R...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_glass_55_1c1c1c_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):323
                                        Entropy (8bit):5.998240864963048
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkp4/dknvmNpO+i5sjLuQzgN+E8VLEMlVbEbp:6v/7JSU4kvmNU1GpzS+EELEMPS
                                        MD5:F7F7F2042EC068FB769B614ABC136089
                                        SHA1:8AD56700FB8DC32FCABD4604128C9C29814CA17B
                                        SHA-256:EA8CAA1338B99BBA1AD99BAF12910FC9659CE3CD717BB7A756F395F8CE1186AF
                                        SHA-512:145D31F2CEF8B1A9051A7B19E5666D83148866068AF6EB6268F7F1C9CE81F8EB741B719FB39B344FD17C5CD8C3129664925AE85D94A309512B71400D8D755C1F
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......KIDAT8.c.gb`.E....AF...;.K...+..K..fLl)L.....1..0..0.=eb.db.ab...X7...EC........X....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_highlight-hard_100_f9f9f9_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):315
                                        Entropy (8bit):6.069460361707883
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/+rMiManu6qbNb1Z5/0xzgN+E8VLEMlVbEbp:6v/7WdULx/u6qBRHgzS+EELEMPS
                                        MD5:DD8011FFC4BE430E76DDA8C3DF420FA7
                                        SHA1:2635A9A6806D0CE478500624EAEAC4A0CB3638CD
                                        SHA-256:7275896D796C6A96FC4CFB741BAAAB19A2A9062923879CE19BA13A85D07575B2
                                        SHA-512:964C87BECB4621A647DA780A4EAD464D94E61DA9451C9F4DF755C04A17EA9D9265D3BD090F0ECA8AA3DE5662707FDF236E7F990275D9D4174BBA1A688891DA83
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......CIDAT......0.@.....].)P.b.H.;....%a.&7...<!..W..~.F..%UN"...'........|....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_highlight-hard_40_aaaaaa_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):316
                                        Entropy (8bit):5.953737371641402
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/KjtXL85/j6czgN+E8VLEMlVbEbp:6v/7WdU185/5zS+EELEMPS
                                        MD5:3B10BAFB1BFEBC8958BFAF5AA18372D7
                                        SHA1:D77817917C1C2F2002AB60481B07CD3A004B19BE
                                        SHA-256:E3E1813A7CF5A6DE95E8E11FFB960C7EDEFD7FAAD9231C82B614A33A4C7E843F
                                        SHA-512:24BFB8E3E0AB53A31F05B54C8A7FB37F814D944C3AE234BC02A252CC152ACBE529336FCA138D3755F0B57EB7F11A6C0190B61C4F98CB2480619FB69645300375
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......DIDAT..c....0p....#..g...3.|......?E...L....;1.kg...........N.&......\N.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_highlight-soft_50_aaaaaa_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):327
                                        Entropy (8bit):6.091868777218178
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/Kd+/G6VUUPTSW0xzgN+E8VLEMlVbEbp:6v/7WdUjd++QPTvIzS+EELEMPS
                                        MD5:A7C11E299800DCDB2F55A13F45B918F7
                                        SHA1:37A870A99EDDCBDF6AFDA87CAD35FF859DA5ACE3
                                        SHA-256:504BBD359106983B5F2308454EFF131488AA8D7045024404D38B5B33DF35731A
                                        SHA-512:9086DE10BC06FBB4B39005A4701A344BFAB32868CAFD5595AE96DC5C79F3F4C79369DA91D12CEB44BFC0D5C9113491F0163176A22967BEB4C1259112A01EF2D7
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......OIDAT......@..v".......z^".xJ.o.....3.... u..g\.q......^9Gr.c .+.6Z........$Wq......%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_inset-hard_45_cd0a0a_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):382
                                        Entropy (8bit):6.324898529211006
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJ4/YWBCKcBEtB4TxlkYyoLmV0mpmI2zgN+E8VLEMlVbEbp:6v/7WogU9+zW0KrmxlC09xJzS+EELEM6
                                        MD5:0C015DD5EA07876869017B31E20A21CA
                                        SHA1:E7AD3FD785801B29871B26B93C815B0823A21217
                                        SHA-256:6BF056456FF1EC2AAA9E7EC59C12EE6C27BBFC1815040AFBB71F676510EB9EFC
                                        SHA-512:9E538918F1B270233B0FCA3237202FED8DBC057007F8DE14494D531D36EDE0E992F79C17623DF172057441671AB9F8E4BF2DBC839115FA9D8E0BF29F12082F70
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(.c8{...........a.".b8..}........,/.._.a.acb..r.....:...%...TDUD..m......D.D...X....*ab.`5e5eb..z..8.#...>.>.L...............O...I...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_inset-hard_55_ffeb80_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):367
                                        Entropy (8bit):6.3091011246601845
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJ4/mi30kxY5/Us8hspVXE7zMr2zgN+E8VLEMlVbEbp:6v/7WogU9+OS5csQsYgKzS+EELEMPS
                                        MD5:CA9994B73AE1D814651B5C432454C125
                                        SHA1:960844631D6DD1945B037F7A1C34BA4BF4FC069F
                                        SHA-256:7EFE027B1718E3D144748C0536C3F2F51EFBDCE091947D3130B1E1D758D79945
                                        SHA-512:599891DA64A297AB12F061E30FCBAD13BE729C7647A58AE6850CCD4050169ADE5DE1F964A79F97209BDF41C5E0C5E1A36A409166716430FAA27752E78D0F683C
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......sIDAT(.....0.D...-Q.Af`..T..=....D...sd.....S...B..t.Qk))..v~.N......h.....L.&...e...n.Z?.3.l......^......oV.....i/....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_4ca300_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.750560950350824
                                        Encrypted:false
                                        SSDEEP:96:UNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:+Hm231Nvu+wIqltWOe3nIP
                                        MD5:9D55E0E837EE95E3E837DC2E0DE0F7C8
                                        SHA1:95EA22082368AA0BBEEE4597E7FCBEC6C4CC881F
                                        SHA-256:457C38A99605DAF10195C3A8C87C06318FA0FF040B75A600A8D54604490BA97A
                                        SHA-512:F903837E8FCAD110872114B9E3C1C16C6FABAB31CFAFD1C602FC2B0CF8CADCC99AC2DD9C7AD25D18153D391632CAE8BC508901FA2E510A85D8C250A796F27852
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEL..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L...<.k...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_bbbbbb_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7092
                                        Entropy (8bit):7.923076697213992
                                        Encrypted:false
                                        SSDEEP:96:+bdL0XdnQW8FLZ3Iz6QlfUGxGO7TjLZxkSR5jsUeuOkjFWr4n2Otk54c+tEBNrDb:ykSFt+7/xpT3Zua5gewr4smcZrDaIx
                                        MD5:947F1A81E0EEECAD8A78B92B269E3C2F
                                        SHA1:4ADACD01B707EAF141426B565937D0651EE0F808
                                        SHA-256:748E923944BED881A8384BD8F6A90D83BA56C30B3FDA34E77A3A2EB3381518F1
                                        SHA-512:41C5907FA5532A13490E462CB9D5218FF06CC8B0C40DD29FCFD4BA55FAC3225D0B13A55900A3CD77B6ED36996A003D52C63A90622AEF6DB6353009892A6BE1B2
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD...>I6....tIME.....%...'E....IDATx..{.eE}.?.H(bX.1..[P.`....J.H..Ef..M.b...F....,.3...`V.;..!.]..E.<.K.@U.#"..-.gWEBL"8+qW..q.#E,9......9..w....{..u.........u.(.M.i..G....... .EH...Hx...2..$........+.\.....8..................FOoi...3.Z...W".0.<D}DV.....B.7n..Q'.....+.....q..$..q..v.C....B..T...2..m..k..5e[.7............x....T.M...M.^?3`.J...[.....Z...S0.Ms..}`.....T(/.f.}......<..)...]D..`....0.../..._.l8..4.^.../........@................=..E.M..2....`gO.{..:\.}....=....\.z...\..mc.-...>....(....W..P&}..n..b.`.....f.Q...P@..P].Xq...a.............jmP.I..U.A&..........%..`.._9u.......W.7.~!.....px.h8..4.^.../.......~g`...q...Zi...Q/zO*..9..9......C..! .....?@X.R.U.a.`}`L...Uc...%T...I.l.......8T.K.B...%...&..{FL....f..-.....g.....u..t.....H.(Z'.a.;PR.OW=%n^.<...9.t.f..e.e'..C.r..jm...C.&...[..LM.%m{...e^....%..f....lN...u..d{..$.*."n.K9(...u..f..c/.<...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_ededed_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7011
                                        Entropy (8bit):7.932572114070276
                                        Encrypted:false
                                        SSDEEP:96:1bBnMc0k8bUamXEHXe/FOIg7O/8zKLnH+48ZJsihJm14JQZOZ0l0z3QODetQ3KxF:4dnmU3QOIuEH8s4JmYQZVCNStQ3KZZ
                                        MD5:65A3748BAB77F6483133EC328B188064
                                        SHA1:F57C6E88D41BD50674D2D017EF9AF010046A9F07
                                        SHA-256:86069EA4DC6EC1F1E7BEB42F4D2FB463FCE56BB5EBB0E9EB35AF805CA437A995
                                        SHA-512:64CB897C58F276E07F5F10FF399F48B720C8AFB5202C823DD64180B1BEE7D6460B6D32826D3315457A38085DB656C077648EB81432F3B9D3E2E7C0D7A26745D6
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..t6......tIME.....%...'E...FIDATx..m...y..c.Z.....c.......BR)....6.bz.H...I.i.z.w.......P.-...z.6MR,...U.X.b;).n..XCc..8.*.......63..{..W..w.s.9...9.s...7.u.^W...p..9..D4.i...K.G.4...su.@......._:........{....H.}....:...u~?<{S..t.H.. P.|H.]...G....p[.....}X.U..<0...)..5...x. ...>P..\.......e....W..m.k\FHz.}.h..=h.>...T./......%W.g..^.@.]....F-{.K........dS?..P..z.=o.&s.......{...D.....dn..k.#@..f.k.G......p..9..j.G......p.........?..G.........`VO....9<..@...?...L.j.mS|.-.~S.s.Ou............R..mj.)..?..v......eG.....@.].U/ Oc.?m..t..]......E.,P...3...?..\..'.rg....S....._b8sp..&.j.G......p..9..j.G......8....;.=..>WZ...U..F.e.|c....9{p.......o.../!)...0.?P..-.L.....&U..+.....,.@..h .K.5....y...Y.......+...7...M,.?=..^..[..H^.:x_k.4..Uj..=.4}v.Y..K]._#..\..6H........cJe..r...r=..u..).l..nA...m...y.L.8.Tr...43X_.....Mw...6..ea..Y..H.`.uV{..,{.n...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_ffcf29_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.767851566820116
                                        Encrypted:false
                                        SSDEEP:96:WNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:oHm231Nvu+wIqltWOe3nIP
                                        MD5:E03E6956FA5640722F7BFBF9F22760E5
                                        SHA1:E18833F077DE41C9A359BFDB7E7DF79131DBA564
                                        SHA-256:1A5FE2498D6C5FBB906E0A68C0A48BF08DC144A7CDEBB983B6F17CB35198B9BF
                                        SHA-512:F258995BB5DB6C920819093DE011B79201B6AEE90B57E20E1F781393E0FD4B5A1F26CFC6BB623F070B524E1C384A56CCAE932A984F650E07A66F8CCE62252771
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)A......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36674
                                        Entropy (8bit):5.276783694401348
                                        Encrypted:false
                                        SSDEEP:192:10OW0SvuQb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHVVoEa:evuQb/+vaW1e07asF5fyzE+DS25Plak
                                        MD5:BEED825A76BBA558B11EE1D2683BE1F9
                                        SHA1:5B3865CC0ADBB0CF8E54AD63687BB5B8D84878E6
                                        SHA-256:1A81C06B3EAB67DBD6225F0DA9C691D52C3E9212A4D56CC078C75E816DF65160
                                        SHA-512:9AA268EC3CC7C85007B45A26700BD0DF0B84800843DFB8A5BD752500932D407EEBD4EBFCAFB6BBDB4C24E438A2FAC0CA045D75DFD455DC1A8AA1B757C67747A4
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=333333&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=8&borderColorHeader=a3a3a3&fcHeader=eeeeee&iconColorHeader=bbbbbb&bgColorContent=f9f9f9&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=cccccc&fcContent=222222&iconColorContent=222222&bgColorDefault=111111&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=777777&fcDefault=e3e3e3&iconColorDefault=ededed&bgColorHover=1c1c1c&bgTextureHover=glass&bgImgOpacityHover=55&borderC

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29598)
                                        Category:dropped
                                        Size (bytes):31403
                                        Entropy (8bit):5.218906180606099
                                        Encrypted:false
                                        SSDEEP:384:evuQlcR8lOXHc11evhdaizkmm+4e6GpbPJSc7nfZBhVwWGc:e2LXHcEhEiz1+e6GpbP3Bh3
                                        MD5:1A7F4CBB81865BDE3C2688094010597D
                                        SHA1:FAD0EA59849100A277AB699429B6ED863C50DC01
                                        SHA-256:332BB17ECBC7843D708B19820FE827737CDF11059F28413111B86004382C69B3
                                        SHA-512:D38AFB63C3784E1ED527EA86FB868154857C01090FECC262E792032387464D8D343E3BF03B811AEE0CFE7F95A1B496AC72053E7BD5F547EA61932570655A5899
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=333333&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=8&borderColorHeader=a3a3a3&fcHeader=eeeeee&iconColorHeader=bbbbbb&bgColorContent=f9f9f9&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=cccccc&fcContent=222222&iconColorContent=222222&bgColorDefault=111111&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=777777&fcDefault=e3e3e3&iconColorDefault=ededed&bgColorHover=1c1c1c&bgTextureHover=glass&bgImgOpacityHover=55&borderC

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1382)
                                        Category:dropped
                                        Size (bytes):18020
                                        Entropy (8bit):5.077568249061877
                                        Encrypted:false
                                        SSDEEP:192:XsvusVoEH6u5F5fyA7F4EcItpog2rgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhKPT:Xsvu/sF5fyzE+DS25Plak
                                        MD5:306C70C02BB94F2FE6365BEB055BE475
                                        SHA1:2C44EA8724D921ED0727013AFFF16FB9A2B14B27
                                        SHA-256:598AC7113B48B1FB114DE7DBCA0345A46623EC632238FAD2F32F46DCB5FD5374
                                        SHA-512:31049FA51EAB36D6E7E5F806D1E59DB021CA3453CD3FD5E64AB05276F1CFE4B9356979DE6BDAB7FBCB8132F8C76F77E437624C044BFB3C08188DA4924B7A8632
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=333333&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=8&borderColorHeader=a3a3a3&fcHeader=eeeeee&iconColorHeader=bbbbbb&bgColorContent=f9f9f9&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=cccccc&fcContent=222222&iconColorContent=222222&bgColorDefault=111111&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=777777&fcDefault=e3e3e3&iconColorDefault=ededed&bgColorHover=1c1c1c&bgTextureHover=glass&bgImgOpacityHover=55&borderColorHover=000000&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=ffffff&bgTextureActive=flat&bgImgOpacityActive=65&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_diagonals-thick_75_f3d8d8_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):471
                                        Entropy (8bit):6.7049806814793484
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+KOp7UknnhJJCKHh/lzS+E3V+2EMiVw9:X9+5p7UknBRBNzjE82EMr
                                        MD5:B58EEB6905F1DAE619D559C85401D8B0
                                        SHA1:CFEFCE2277F8EAA63F8C9B05DBCE40A2004D2335
                                        SHA-256:35E18EE04B19399AD8F10DCFA7C87CC34A651C86BE4FC8FE1FB436945A222FFD
                                        SHA-512:132277DC65EE61A38D67F8AA92ADE513DA9407AB90542D29645CCC317F45CEE10B0616FF443F2D45878B3A59E00A480733F84B0E9C35ABC75677AB9A5C4A6C03
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATh.....0..a@.f(.J..2..7.F4HiR..K..t..U........m(..:.s...?.....N~.E0........U2^W.!x.J&.]..*..r7...&0.Z..E0........5..P#..Uz..-R.V..R.`.T..Am....0.Z.S..0...=P%}..R..E.6.I...G-.....MM.......~.}.S.`.T..A.............%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_dots-small_65_a6a6a6_2x2.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 2 x 2, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):266
                                        Entropy (8bit):5.610835048236541
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPg2pUyKOkHkNtF6oXmj2zgN+E3VKF2EMiVAVTp:6v/7I2pUb9j2zS+E3V+2EMiVw9
                                        MD5:514220F4C236074C7FAED6FE1C61D0F2
                                        SHA1:47FC23159EBD07EFD56CED673588FDEBFC93A411
                                        SHA-256:9118A1D5AFCD3E5295F40A64E8055E751E0F1BF60CE75BC6D62945EDE01AFA2C
                                        SHA-512:1220D03411CF36FD1943848EDF867A8CD0FCB664CA939DB447C3A9490369C85B7D6DE8E6EEE10D4F1DFA03BF30B3B739A5BD17108A6F2F3A3958F1313570ED51
                                        Malicious:false
                                        Preview:.PNG........IHDR..............M......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDAT..c\......AV.......l.n...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_glass_55_fbf8ee_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):398
                                        Entropy (8bit):6.489244714170791
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+d5IpGI9vAvTMbubI2zS+E3V+2EMiVw9:krr9+TIpxWTMbudzjE82EMr
                                        MD5:D93B9B26FC8C0C5959B707DA1E45E788
                                        SHA1:813E0CE3C904F5702A8FA7975D5064347DF601EA
                                        SHA-256:DD54BDDEF4B35E2C3F7AACE9527EA022E6D0CC02A54178F4526045EB4C947900
                                        SHA-512:06064F68BC510447E9960469D9AA90D6F08B547184DA0DC98277C0D265CC429D85270600B6F9D8F5496384B8CE54A0D1E25318D40E0748480A794C5E59B811E7
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH.....@.....)D...6....u..%,...i.@&...M,\ B.I..p...U_....ln....(......I7z.B.\...,,q."X...%3Wae...G85N.d..6...a.^.bp..wB.....GAH..EZQ..|.pz(/.*.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_highlight-hard_100_eeeeee_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):316
                                        Entropy (8bit):6.004377221346415
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkNQFicpa4b+Npj2zgN+E3VKF2EMiVAVTp:6v/7WdUkF6c+NpyzS+E3V+2EMiVw9
                                        MD5:15685D4DCE0B8FFF8B3810B016383823
                                        SHA1:053F0D670552C5D15AB78A41A02974715D0A416C
                                        SHA-256:D06EC7B51177FDB1ABF190EBA73D582FD0985E50E769AF19F9446D5D70CEDC55
                                        SHA-512:57E111F28AC6F71CC460D290464F9216E2298A25DFF7E20E7B60DBD24F7FEFEEE99131D1A6ACF47182831A6557FEBE719288849EB782418FE0D1EA5233E498CB
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......DIDAT..c.....0p.=...?$...0.7b...._.......O.L....;3.?......u'......u...y.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_highlight-hard_100_f6f6f6_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):316
                                        Entropy (8bit):5.9763265231364215
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkNKgQiPkpP2zgN+E3VKF2EMiVAVTp:6v/7WdUj/Po2zS+E3V+2EMiVw9
                                        MD5:B9D37A48EBD94443F5C3E2822DD090D9
                                        SHA1:55100A616B47D71C9E438D9061438B2A706F7BFA
                                        SHA-256:2358CD25032A62FD31EC70B69DF51243019A7EFC155D8A1507B5411355F8417B
                                        SHA-512:FE43ED77F5D635F73761AFC40178B37C34D29B1CF0CAD29D55FBB6DA644C2E335F0D4DF5EAB6FF13D324E707FD01B8DB5C50B8726D95866F419F4B31CBAD9E2F
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......DIDAT..c.....0p.;..%......0.f`....K...T..b.?.0..b.~..a).w).o....L.......k.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_highlight-soft_15_cc0000_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):385
                                        Entropy (8bit):6.424213165792157
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9++Mef7VkGTqOgzS+E3V+2EMiVw9:no19+7ef7TTyzjE82EMr
                                        MD5:14A6FE8CCD61F8625F5DB721CBC48424
                                        SHA1:DA6981BB8CE4F183C5954B9840C24F75A4E7A69D
                                        SHA-256:78C17A090E9CF7DC82BB4E51A760015E73734EC2DA03730EF585BA52A92C0EF8
                                        SHA-512:264750DD734D000458706FD32340B8EFF021FEDA7FE2F5E925C2F5009A1EA1EDCF2C47A515798BCA8F2003221210AFB2D1D5BDC1D6E72F4C8FFE96DE07FD7758
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..;..@.Dg..,l.....4...t.5.t......|)....T.....y=...$..>..V..h.D..D.EMm...w..LK"Y72.j.&.%..&.Hz\..X.8?.V._Pw.s..9T.2o...|..../.`..?.7...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-icons_004276_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.74148520890888
                                        Encrypted:false
                                        SSDEEP:96:kNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:uHm231Nvu+wIqltWOe3nIP
                                        MD5:265053FC5F278803065C40324D689469
                                        SHA1:2AE551B825ABF8171B75BFC51D4F13447381FC3E
                                        SHA-256:4F6176A29AAA41A97A732AB8071DD9C12BBE85502EFADBFDB5814146DB5C7408
                                        SHA-512:2917C7518C6E4624BC0C3816B34135CDCAEB1833B129568BCE3A812364EB0E822B131F44F4921FD42F46452668DEE6442EF251DCEF1564505AAD33860937B685
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv..A4...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-icons_cc0000_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.702553996522658
                                        Encrypted:false
                                        SSDEEP:96:NNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:dHm231Nvu+wIqltWOe3nIP
                                        MD5:43C9C3B95C08C992741D28AF12E36597
                                        SHA1:0F8640441757AC39626E42E6072B5E054F3523D9
                                        SHA-256:679FD5C7A9307B11B44F72140129D489B2CDA77C9001CCAE7FE7C564534FBA5B
                                        SHA-512:2D0BA16FAF9239D809E3C05C5561CA7F838CC013FB71357D83A1BC321B97D8DFF4F7F722E051767DD8336ABDE86DEF3BF569FE69FF485EDC959104F8F69080DC
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................xS....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36567
                                        Entropy (8bit):5.275179603321093
                                        Encrypted:false
                                        SSDEEP:192:10OW0zW61rCliJI5bZb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMEA:2Q3iZb/+vaW1e07CfF5fyyEpDS25mCM
                                        MD5:BDA6B84BD307940ECFBC26AD9C5F8D8B
                                        SHA1:0BE54254B17821EE818E3384C34DB140F01FBA8E
                                        SHA-256:0EACFB8B5C21F4E24DD4B641EC9D3A02A3AD5C22CE0ACBBDDE88049B62CE6558
                                        SHA-512:5CC2479EDE5824DE6EFD5FBFE8065D2D6FEF494701C49A6CDDC1FAB5B5B984A30F03AFA2AA7B1412933817E5F6C4839242B761458A733324B37276FEE0C9EB8C
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cc0000&bgTextureHeader=highlight_soft&bgImgOpacityHeader=15&borderColorHeader=e3a1a1&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=eeeeee&fcContent=333333&iconColorContent=cc0000&bgColorDefault=eeeeee&bgTextureDefault=highlight_hard&bgImgOpacityDefault=100&borderColorDefault=d8dcdf&fcDefault=004276&iconColorDefault=cc0000&bgColorHover=f6f6f6&bgTextureHover=highlight_hard&bgImgOpacityHover=100&borderColo

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29518)
                                        Category:dropped
                                        Size (bytes):31305
                                        Entropy (8bit):5.217186999993763
                                        Encrypted:false
                                        SSDEEP:384:2Q3iZlcR8lOXHc11ev9/nz1mzn+4c6GX9NISc7nfZBhVb0u:XiwXHcE9/nzgvc6GX9NYBhn
                                        MD5:37CCFA3CD39F71C0D6F05D8F1F3BE4EF
                                        SHA1:FF286271B64BE28ECBAC62BAB9D2DAA815294737
                                        SHA-256:70687998314C27942EA241BBE9929C05ACAD1074DC1C93A24D7872C70A241319
                                        SHA-512:4AC26AFA617A491F8D4791A2CE05425110F7F5D2DF1D983630E244E5EA06523D299B731CCF4BB1A37EF4A42F372FBFA19EBC615E471978E712389AE3D2B50B68
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cc0000&bgTextureHeader=highlight_soft&bgImgOpacityHeader=15&borderColorHeader=e3a1a1&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=eeeeee&fcContent=333333&iconColorContent=cc0000&bgColorDefault=eeeeee&bgTextureDefault=highlight_hard&bgImgOpacityDefault=100&borderColorDefault=d8dcdf&fcDefault=004276&iconColorDefault=cc0000&bgColorHover=f6f6f6&bgTextureHover=highlight_hard&bgImgOpacityHover=100&borderColo

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1364)
                                        Category:dropped
                                        Size (bytes):17913
                                        Entropy (8bit):5.0738958492108
                                        Encrypted:false
                                        SSDEEP:192:XJW61rCliJI5bEh2UO2VFF5fyVj5SvEc+1bqyQagmB0iBfT9RhS2wV53skuMaaS0:XIQ3iKfF5fyyEpDS25mCM
                                        MD5:B16AFD83FDE3A4441D2014186A13862D
                                        SHA1:BA5CE93C86044EA086F3D6FC40A01BD36801FB00
                                        SHA-256:A81FC809E067BE4F135446F6DBE947D2057DA16924E9680467167C7676D47FBD
                                        SHA-512:D5EBDD4E550BBEABEAF75513B5FDFEE2A9B80C1B440799B6B63825160F3920F1F929BAFA441A9A5AF76E2B998180A382B5780CFDEA983A56C997FD287AE1C289
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cc0000&bgTextureHeader=highlight_soft&bgImgOpacityHeader=15&borderColorHeader=e3a1a1&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=eeeeee&fcContent=333333&iconColorContent=cc0000&bgColorDefault=eeeeee&bgTextureDefault=highlight_hard&bgImgOpacityDefault=100&borderColorDefault=d8dcdf&fcDefault=004276&iconColorDefault=cc0000&bgColorHover=f6f6f6&bgTextureHover=highlight_hard&bgImgOpacityHover=100&borderColorHover=cdd5da&fcHover=111111&iconColorHover=cc0000&bgColorActive=ffffff&bgTextureActive=flat&bgImgOpacityActive=65&bor

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_diagonals-thick_90_eeeeee_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):380
                                        Entropy (8bit):6.468213795058188
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP0CUyKOkZGjpHrlcFtgNxC7eGoEJByG2zgN+E3VKF2EMiVAVTp:6v/7MCUjGjpLlcFtsEyG52zS+E3V+2Ek
                                        MD5:254973041F2F3FF094034CF79E1DD669
                                        SHA1:4CC6098DDCD7ED82D12A426903597135E70BDF94
                                        SHA-256:87FB6CDDADBE598544359DB6A8C084C5576A82122C4877D6BCF235FC9E0304EA
                                        SHA-512:E55C11AD7D6790FC3B65D3539236FA099791B8974DA49BCD5BB265343A5EFBB4D5312C9CB3417AA66C876DD1A3BBD6BB9F7047D066CAB00C2A048F5CE8E4BAC1
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDATH...1.. ...g&..9{...8v.."....7......C=.hI>.......)...'..I.V.....Z1.[6.s...&...Hq..8.XN2..|l..Oc...Sa,...!3..N.s.).).)..S~.)7x...[.T...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_glass_100_e4f1fb_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):408
                                        Entropy (8bit):6.53300658338152
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+BX/ut8OWIlavzS+E3V+2EMiVw9:krr9+BpbIlKzjE82EMr
                                        MD5:CEC0B018D99CE30327D69D3C4FAACA11
                                        SHA1:8FF0F4BA794B38F968D84C037DA4640AC8284EEF
                                        SHA-256:DC094D8BFAC52D7F488851A2BBAF0C87D22FCE9B582357B012030F8CD9905F81
                                        SHA-512:3D8F0C7DA9203A946AAF9E211C29BAF053D13A5125A8DF7040A1A8008DB2F18C56C9AA705427769D572E2F7C05A5701FA7E1C313A05BB922BEC45A9F18690E85
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH.....`....y.$.Q..0..d.b0...z"...,.;.....a8..|......c..o...7^.jg.....(..m.e.4..a.=a......p..b..5S...Y...Xv...<.p......{B../..z...b.0a..`.>:.1.(..C.I./.b.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_glass_50_3baae3_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):394
                                        Entropy (8bit):6.428194654529718
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+rX4uXpVsOiIENIzS+E3V+2EMiVw9:krr9+Mu5V6IENIzjE82EMr
                                        MD5:BB06E6A2F7440CA2A11050057FE7926D
                                        SHA1:8C66858D8FE1968DFC47EFF20071419BCE199A28
                                        SHA-256:297D55F5A34F5F3B6CE0E5E7452CA5657220E24B0A6579B833199C102E747E96
                                        SHA-512:FDF6D59296056B5D0D080D7245F782CC692D84A0C6843EF5F061BB7187942F68DC641D9C281A556CC6BF33C49F2F484956EE0A76A256CD644384ABFDC7727DD0
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH.cH..{..&&......Qj...F.Q....e...Jdb.f\.h..R...P..r.i.c.....u..L.,L...!..&.t....Ll.L....X.211.db.c..8........LL.....L.....|....(5J.R.G..2.!TT......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_glass_80_d7ebf9_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):404
                                        Entropy (8bit):6.478097767551162
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+0B80mmp1tqzS+E3V+2EMiVw9:krr9+0STzjE82EMr
                                        MD5:286B528907DFBC11DC44A4CC89681635
                                        SHA1:BB075DBA4E783299AC06F110BFD306687D8ACF7B
                                        SHA-256:E240FA34AA81B5D4C07650F52C4365E15477DE775F19D12F9B66068A909D1C75
                                        SHA-512:DE9F032CB8CCD1AECC56F27A1FA49B5126E9C26F776247551FB766A21EF2303CAE2845A3609F2D721ACA1553FE0AAED93748FA6B07CF65D0300E769B27E7EF77
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH...!........fs.jpc.5.4...l&...08N@2;<..71....A.H..N.......w.....0.o.4-.....N..8B.....3dN.k.......]..+<1....2..|^.Z..}unW.....&..k.E.}t."m...C>B3.N..L....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_highlight-hard_100_f2f5f7_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):390
                                        Entropy (8bit):6.505409455044373
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+BF1J67j9szS+E3V+2EMiVw9:no19+BPw7pszjE82EMr
                                        MD5:DC0A7DD2653B260113C92C1936198B21
                                        SHA1:D4B267AAFD2A80DD47F11448D0AFB31688573D05
                                        SHA-256:10A05D8BE2E8C53FF0BA522E023D6ADF89F5A613F2DA25DC8AC05EB727276853
                                        SHA-512:C9AFD3D5618BF84CF76E0D73F3764798219E35FB8BB25BEA22C91374C0FDFFE41D5AFBCBD7F9E8C550C1DC2A0FD28D9C5F2C93377A54261E9ED433A41AAA4F20
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....@...?...P..fAT!.q..Y.....A!....a.D..w..&0....>...f.5..?.h.H....,.g.">.F.....jm..J..?.#f......C....d:......k..v.S..4....O....C.,MK....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_highlight-hard_70_000000_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):310
                                        Entropy (8bit):5.946430929652425
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkomhhPhgTljzAiyG2zgN+E3VKF2EMiVAVTp:6v/7WdU/VqlzHyvzS+E3V+2EMiVw9
                                        MD5:3AD15B0B6700A003DABEB7052E80BE64
                                        SHA1:B0E9C09B2F1621EDC0482CFA6474F0FF1E123031
                                        SHA-256:4872389BEA563094492E06B11519EAF3F1A3FFA2EE8FF1F05BD2737B8D6FB728
                                        SHA-512:2F852E50D491F6353A7F005BCC2A2FC9E4C391C2E0FA184F10EC92BC8C7D72BAC77513E2CA19A314E375EDC57E8B6269CE00B0EFE02A830B333AA67E88E52896
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......>IDAT..c.neb`.0......_k.~.2..2}......w-.o....L..1.h1....t.a.........<....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_highlight-soft_100_deedf7_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):445
                                        Entropy (8bit):6.748188273788987
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+fZVCDygfx6n+PnrtT1pA+nzS+E3V+2EMiVw9:no19+fu3fx9nZjA+nzjE82EMr
                                        MD5:C04E9AD1E86CED01D2295FA5DF2D7B56
                                        SHA1:039C02919B57BFF2C4DF3A5A6AB8C50AC547D1A2
                                        SHA-256:7A101E445F20FFA93CB93B02A89368C92A9090CD8637DA607FD1874EF7418BE7
                                        SHA-512:F671FDCD62BB305713E16D98435124F784DA3F95325A3546E6D9D37F34C7FA606B61BD23DD8B0F3F0A6D3D5CC40CB80B8CD573BF3AB35DAC1EF6BF27262289D4
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..=j...@...t)..N...P..t...%..=C...frw.EL.v).@E..mH......P.......Z._......*Q.....1......U9...u1mB.va6......._...u..:a{...h.O..*.U}.&..v..>2.5p......M.+.:.M.....u..1..>.V..A.../.9../^d...c...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_highlight-soft_25_ffef8f_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):367
                                        Entropy (8bit):6.40916101784247
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EiBRq9l+4uMxfqVH4IWFGT3i+GPuObzgN+E3VKF2EMiVAVTp:6v/7WogU9+Qqk4pCKIWFGT3dGPuObzSl
                                        MD5:870E4DA769784845BF381570AC584621
                                        SHA1:9BAEC551921D43CB38F47303ABF9ABF8251B26BD
                                        SHA-256:EA1D0790F41DE22703A5C96388E57C3646B597DCA181D9A0B9D3D729ADEF1D99
                                        SHA-512:3D027DACE55050E0A5A166E6B2FEA9A355626392D858B3FF4D1F5B915FF7F9744A2176E3F34B1534D753AF93EFEF26BA0AE087920F448919ADED54701039B5D8
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".......sIDAT(.....`...W.>...&r..[.nK..z.. .1.<.!..$..0....{)......0..0R~..7...@...k....-I..]L....:........X......_.il..5./Q.6...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_2694e8_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.770267640169761
                                        Encrypted:false
                                        SSDEEP:96:XNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:PHm231Nvu+wIqltWOe3nIP
                                        MD5:A1CE3CC448B059968BB35B71A5C91874
                                        SHA1:38D446EEAB80F7FBD7772B215267D6205B96EB39
                                        SHA-256:4A7C5EDA027930B4803E24985B3F5EF61E7EF7A5051350BB9E7282843ABA9660
                                        SHA-512:FEDE7B7F4A6DF4BA309F1E44E642EF2BA2242B84AB472CD07F582CBBDC02142AD349E4ED8593DBB1B8C6F3ECD2313B32F94C9026C08F131434C3A5722FE3DDA7
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&.........ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_2e83ff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.770844676212274
                                        Encrypted:false
                                        SSDEEP:96:aNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:UHm231Nvu+wIqltWOe3nIP
                                        MD5:DB3B908BD060C6F278FDE9E11B3B94E3
                                        SHA1:3F4A9C46377EECDE2C1368EF2B963712B8DF5C75
                                        SHA-256:CA8FB2EB9A086B0C170EB61317C91138EC06EA0FEF878B8E24D1F50BF6AF2A17
                                        SHA-512:9D27F0E66856343254B4C75969B47B3EBACCD95E63981F18472563D95CB85AE3A1A286187F25DA0AF0996E5C783B8807BABC6C7C6698A180175B06C31A949488
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................).:w...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_3d80b3_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.768766204925428
                                        Encrypted:false
                                        SSDEEP:96:rNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:7Hm231Nvu+wIqltWOe3nIP
                                        MD5:8370749A3E90577FDB876D72E6935F8E
                                        SHA1:19FCD8D21F2C58AF5A00FA7335106A771B1AA04B
                                        SHA-256:2B1BB4B957E357AFDCC51BDED83CCCA68E8B714078FD5E8CFD64EB91863A66C7
                                        SHA-512:8B7CEAAACF6700C04EC27DB0D17B4F55B02FCE43FD950C2B634275CAE319E0030C10D9D14F89F0A34E479CF257C5166CD34A70F9430675A27405D85D40438E37
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=.....(...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_72a7cf_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.77096565541329
                                        Encrypted:false
                                        SSDEEP:96:1NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:FHm231Nvu+wIqltWOe3nIP
                                        MD5:505F6857CBA9AAD738957A7D3BB226A9
                                        SHA1:0A3A485514E98964B25F3BD96F2AE4D1AA0BE8B2
                                        SHA-256:882C69929DD8EFB562A20CAAA71EE3A068810C1F7A0575BF1D11C0A796A9B1BD
                                        SHA-512:CDE1BAA8306545454FFADBE58CF0CE8EBA08A7BF95DDE31CBFD1885C4032107F622E5AB67152040B7C92D5E3E3E42A9B5147EFC8249E90C8AADCBEF9026910B9
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEr..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r...^....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36724
                                        Entropy (8bit):5.280856349526157
                                        Encrypted:false
                                        SSDEEP:192:10OW0wlNIb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHC1j/w:cTIb/+vaW1e07VF5fyVEaDS25c
                                        MD5:2DA18ED46C347B06B53DEA4457D1A31F
                                        SHA1:669C6DBBB0CCE33E59120BF7A94CE704641A236A
                                        SHA-256:31917832E32411F18694AD6F7F10FEE76B7D35D45854E1E146D74A80FAEA3C1E
                                        SHA-512:D7AFB9AE8CDCE198F3502433BDECB2927D03747A72C7AAFEB127E5EF04401979F88664BD66679934D4A59CCD573A57816D00D25EB5F2BB2B9F143B4A290587D1
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=deedf7&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=aed0ea&fcHeader=222222&iconColorHeader=72a7cf&bgColorContent=f2f5f7&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=362b36&iconColorContent=72a7cf&bgColorDefault=d7ebf9&bgTextureDefault=glass&bgImgOpacityDefault=80&borderColorDefault=aed0ea&fcDefault=2779aa&iconColorDefault=3d80b3&bgColorHover=e4f1fb&bgTextureHover=glass&bgImg

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29660)
                                        Category:dropped
                                        Size (bytes):31489
                                        Entropy (8bit):5.22480275794203
                                        Encrypted:false
                                        SSDEEP:384:cTIlcR8lOXHc11evNtKGzdlmm+4m6G9zKsSc7nfZBhVu:AXHcEN0Gzdw+m6G9zKsBhE
                                        MD5:C5518025B115C73BBEB9B8518EC0499B
                                        SHA1:6B06059A32FB214AA46167815A71BA15F8485EBD
                                        SHA-256:050DE6F1B8AB2984735E3A1F609784ADD67F48CB1780EA013D7B7477A7371597
                                        SHA-512:BA0FE9D9F4E7611C7F4DF5602FC7A34D6A256AAF775FEE3CFC52D2F5F29FEC089ACDBC4791210435DCD690EC5B8C93BF5F582B50FB7D1117C1B76D622E1D9DC6
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=deedf7&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=aed0ea&fcHeader=222222&iconColorHeader=72a7cf&bgColorContent=f2f5f7&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=362b36&iconColorContent=72a7cf&bgColorDefault=d7ebf9&bgTextureDefault=glass&bgImgOpacityDefault=80&borderColorDefault=aed0ea&fcDefault=2779aa&iconColorDefault=3d80b3&bgColorHover=e4f1fb&bgTextureHover=glass&bgImg

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1406)
                                        Category:dropped
                                        Size (bytes):18070
                                        Entropy (8bit):5.08870989379537
                                        Encrypted:false
                                        SSDEEP:192:X6lNX1j/kIIF5fy72KEcUplA5OggmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqc:X6T0F5fyVEaDS25c
                                        MD5:3041AB25C76FC2EC2B95B53E5D72C478
                                        SHA1:0052879B7208E43635E364DC0A6DEC5A06F92A00
                                        SHA-256:A606B8C796400C7763591C45ADCD217BA012A282AAA866C686A7AF4E9675B9F2
                                        SHA-512:05D6CC22AD3CAA2E937FE196F070DD984AFEB9CD6EAE67EC3717163849ABC936B731818592039B0AF99ADAB6FE8F125FE354B56718D8EE999D9241DCCE41ADAE
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=deedf7&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=aed0ea&fcHeader=222222&iconColorHeader=72a7cf&bgColorContent=f2f5f7&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=362b36&iconColorContent=72a7cf&bgColorDefault=d7ebf9&bgTextureDefault=glass&bgImgOpacityDefault=80&borderColorDefault=aed0ea&fcDefault=2779aa&iconColorDefault=3d80b3&bgColorHover=e4f1fb&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=74b2e2&fcHover=0070a3&iconColorHover=2694e8&bgColorActive=3baae3&bgTextureActive=gla

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_glass_40_ffc73d_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):374
                                        Entropy (8bit):6.366478028228076
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh1r+UyKfp5En6rs3grEM5E7e+Vn0g2zgN+E3VKF2EMiVAVTp:6v/7J1r+U9+6rTFKe+J0g2zS+E3V+2Ek
                                        MD5:D54912D131FD1851FA51820E2F4563F7
                                        SHA1:F656629566FD2C94EE8AFBAF94B6307C61BD4AE0
                                        SHA-256:A1431E3400C4E0607BD04F20FF1E732D86518492BCD86EDFDA8A64D77422C8DC
                                        SHA-512:6C213534C64A68C44262058C76D5519E7741980BDB7F8AA57726C943BDD2457845C9D204BC9EC2CA52980E6F388E47F1E13C8543207918CA5A711E63DD50264F
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".......zIDATH.....@...}.......f....&..Zh..&..:i.N......O.Z..~kZ.@..A..^.....3..AcZ.TRc.&.....T.A...k..U:...'.z_...0....6..`f>.....A.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-hard_20_0972a5_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):381
                                        Entropy (8bit):6.406906120742124
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJTc8RcXoYbaCb3LU+2BZTrn7q2zgN+E3VKF2EMiVAVTp:6v/7WogU9+G8aoYJ3TIK2zS+E3V+2EMr
                                        MD5:B0763946132B93BEDA0F1906EFDC591F
                                        SHA1:72EFEB7E6DDB671F04484BCE3C8B6A38CA1F6317
                                        SHA-256:FB8D6098D06455C35222B54887FBEF199B2FD2284DFB12195DBF0AEA92980493
                                        SHA-512:24DC3300CF4B68A6388FA7E63C8E1CA6D11F70D6C4B59699AB5E64F80120BAB71789652458DCBD89F15609F006BCE7AAAAE3F9FACFEA52F2407A0AFB97490E84
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....P....m@.Y.3........E...[....@..@...................':.x.w....g(....R'..3.j....i..dZ.2.F..L.#.....j..K.p.51C......6.<...)z...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-soft_33_003147_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):401
                                        Entropy (8bit):6.4893748429272815
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+YUKgyOXiP4UqIKlmagzS+E3V+2EMiVw9:no19+YUrQ4vIE7gzjE82EMr
                                        MD5:B7CFE8282BA59F5F94BEFB7A30688D0E
                                        SHA1:0D1F08900B23BF7464B34EDD54A54D5D83EA3BF9
                                        SHA-256:11C3956A49ECF039AEACB25BCD6A97AA55AA23964E1343BE0E99F73BA1952D0F
                                        SHA-512:84BEE916CE4CF35AF955A3EBC9EC9E8D1C4CAD75E0132FE4BE8A42A5A63969ABBF66EE5815FC8E3353D9E7FAC4668A3D7AF2CDBB54FC06CEF4111A08C6873475
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(....`.._..Yc..8.S.K.KO.2R9.h......n..,.:.&V_....R..w.....N....j4@Q..0...&.X..3n.=...c`./91.w.......'...<..v....-LX....,...5{..|h.....K?.'..e.h.(....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-soft_35_222222_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):342
                                        Entropy (8bit):6.142862152003425
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOk/vt9cG/rPPA1ZgX2zgN+E3VKF2EMiVAVTp:6v/7WdU18g8C2zS+E3V+2EMiVw9
                                        MD5:A3437EB76B200E5987417ED57B97A0C6
                                        SHA1:36C18C07EF26D2FC01D714F93DBF238BE292AA12
                                        SHA-256:B2016DF4E2E19A17838CB87DBB6596C7CE7224F1891825359B92EFB470BBA90D
                                        SHA-512:21403F52A34E87BD0C8DA2AE48232E1E3E74B7A7FBFC863DB2FBB2BCFACE97F36ACAA1892734DB680822519CCF837F515974FAA68858F7E06CD545FE2A6D7088
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......^IDAT..c.....@........*..[L.u...g.w...=.....N`.7...1.....L.....c.;...}..:L..1..3..eP.a./F/.bA.$. .;.0...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-soft_44_444444_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):328
                                        Entropy (8bit):6.102952359110676
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkRUNdnnxLzw2FtjG2zgN+E3VKF2EMiVAVTp:6v/7WdUgxLzpj7zS+E3V+2EMiVw9
                                        MD5:BC42CD9F99AF4032A166A1433A8B5DC7
                                        SHA1:9F0E531F7E09D1F75A9F1967614D05DC2C49EBF5
                                        SHA-256:234DF09388C6338E20CE45E4EE46F946284863FE1150290F134504A910C35147
                                        SHA-512:C6696458597013CE9B03A98B0DCBBF9919858D1D686B62D8C8BF4920116418367AE968BA4FD185ABC08B895D4B59EE17EE187CE0B5F98BD5F4C2EBEF072962C4
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......PIDAT.....0...5.H...u)...(..4B....3...c6.*......&.9.P#..9.. ..WVT..c.u.....#2D..?...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-soft_80_eeeeee_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):335
                                        Entropy (8bit):6.134607764700383
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOk+horavt0CSSZq1ekAYUlr2zgN+E3VKF2EMiVAVTp:6v/7WdUITfSSs3A1gzS+E3V+2EMiVw9
                                        MD5:1BEFF10685B7E41D107652442EAA77B1
                                        SHA1:E605411EBF86AAF94882ECD0BF7C2C57C94703FD
                                        SHA-256:1BD38B24DB181616A1C3EFF5DF444E3D8E33E6C7B620BE748ABE2EECC4A4E240
                                        SHA-512:17A7CB46B69FEF95FBB313CF998526FCD2F6895FFCEA69BA90F370F35344B4AD7C7BC217111B63CE1C56188E521CFD786073248B48F32CEDCCE445E35700E3A9
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......WIDAT...1.. ........v0.......8.......W.8s..<.NPE......!.<..IEL......M.\.0..N.%4x_k...-1..W......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_loop_25_000000_21x21.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 21 x 21, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):378
                                        Entropy (8bit):6.463279097928892
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPtgWUyKOkfrE+kPymX7dN33SJzjEIVKzgN+E3VKF2EMiVAVTp:6v/7lgWU1rxkPymXZd3mEIVKzS+E3V+W
                                        MD5:3F897551A356A1DA748CD9BAF9F297E6
                                        SHA1:023DEDBEAAE7F6CFE6305F66D8951FC12D7704C7
                                        SHA-256:87068005C88A9BBF33DFDAE5A6452C81D9932E1061B40BB6C2EBA332BE73E991
                                        SHA-512:AE35A9E26016DEA62EF39A3602FFFE15661704351CBC91D6F23C259D7B83E2B18BE586E923DDE9A2332C6023FD909EF1C134EDD7BFDA5FA8BE5FADAE630452FE
                                        Malicious:false
                                        Preview:.PNG........IHDR...............&.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDAT(..... .D.,._.O...4~.?.q.2.vI.$..."..O3'b.z8.....E|.|...Y..7-..YM.U3....PV..+...hT...s..v...+Gq...5......b<...o...........u.@......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_4b8e0b_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7718687501842405
                                        Encrypted:false
                                        SSDEEP:96:mNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:YHm231Nvu+wIqltWOe3nIP
                                        MD5:853C2373C51B7B7C545D092D4A98B3CB
                                        SHA1:12270D908EAF7EC8C1D3491C4BFB00414911ED38
                                        SHA-256:FA33C9FAA259211591EA1C144246F1CB01B3CB18FD739FFAAE0A4965B979FF97
                                        SHA-512:89CCA39CACFF95B8DE1D1C29B8587EBABB91FCA2F91EAE1F491F3410C7549981E80FBCD188AF7DB63DF94ED7D2BCD301082C50E01B171308F76931EB2CD574A1
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEK..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K....]l...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_a83300_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.745691045674909
                                        Encrypted:false
                                        SSDEEP:96:PNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:nHm231Nvu+wIqltWOe3nIP
                                        MD5:372DD47E50840F48E9098AA30D978A5D
                                        SHA1:49F2C2A59C0A53F5400BC19F2F66E516699CDF74
                                        SHA-256:5D119EC862AEC3BE0B0722B651C5FEE065AB8255B0DDAD3D01E1A6B929B7DFA8
                                        SHA-512:9E24AAE1EE5750587C76145C557117E51A04E4B8EB0A56A4C2A88F11808118E2B33575B25AB2AD062A1B5862DFDFA7EDA2B11F5D15C1CA3DF9927D7DB81498F8
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3....g...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_cccccc_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7034
                                        Entropy (8bit):7.932139241999848
                                        Encrypted:false
                                        SSDEEP:192:K6OJJxfX8+p4/rF1km/zUCVbGarOXZuphvgXad4:K1JJxPzkFWm7UJZOJgqd4
                                        MD5:883030509884C748B039641F5955E85C
                                        SHA1:FA1BCF0D7310168CF3DD77A30CB527A31EEB6D5C
                                        SHA-256:055799E2F20C94BB0CD60D6AFB71D362DAA66AAE390032AB03C631C92FEC1860
                                        SHA-512:830C390394294C460D177FB4FC0D714D05994EAC8FEB5AD98C42876F204C8FE51983C31536C84B3DD6D8DC172E24555BA06E64EFB0BAC60CB3C5C4BFB7235814
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..8_......tIME.....%...'E...]IDATx..m..Wy.....(..R.....%..H.&.x.D..Er.....(.....D..........R....H.R;..H.]B......P.)mIX.b.R.*Ed.a^...w..;...{..s...sf...._..8k....,<...O..mB...F.. .6+.J.(.k....i.V....EG.$.......`....c........al.N..Z..._.)`Jy...<.z...B.7...N\..X.V...).)..!H..."&...!H.G.NP)~r..o.vX3.)...........{.>|DW75.9.z..i..\...2..g..w....*..cO.|o..n....m..By.....j.T&.y.JR.|.{.^.`....(5........l8<...O........h8<...O........:...2..n..6eL.h.`...y......Q.G.$....4`.*.7.^.k...R..>2...=@..lx..o..m.]..L.3_...0N;.......c..N..:...t..0..ny..'.Z....@.e.I.:...&r.....^.l..+..=.........O.5.....'@....px.4.....'@.q.30t..8._...t..../.0.....TW..c.......Q.... . )....?j......Uc...%T..g..l.......8T.K.B...%..A&~..F"....f....`.........u........H.(Z'.a.;PJ.WW]%...y..rs.Y..A>...}.....[(.vV....7pH..@..V...-...$y.....s.....@;..i.X...v.....Y.v...B....n]g.......W..c.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36670
                                        Entropy (8bit):5.279756253570595
                                        Encrypted:false
                                        SSDEEP:192:10OW07ABb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURH6CrjVb:3Sb/+vaW1e07oF5fyUE+DS25u
                                        MD5:9F6A7C59CB79262E433FF8CB4DCB6263
                                        SHA1:7FA3C00C899E8F02C5607C070AB03E74E2CEC924
                                        SHA-256:E37D1F99DB0795BCA172C98AF91FBDC2CA55806241823916339B6E0765C2D375
                                        SHA-512:C32BADA6D271252248F1F8CB9411506617EC4D61666CAF1E4A4440B0AD664B65762F9BF338130005548A89D527404046E9BCBFA5214475D6CC4E336E333F5CC6
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=444444&bgTextureHeader=highlight_soft&bgImgOpacityHeader=44&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=loop&bgImgOpacityContent=25&borderColorContent=555555&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=222222&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=444444&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=003147&bgTextureHover=highlight_soft&bgImgOpacityHover=33&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29589)
                                        Category:dropped
                                        Size (bytes):31390
                                        Entropy (8bit):5.222338758092407
                                        Encrypted:false
                                        SSDEEP:384:3SlcR8lOXHc11evA4zkm++446GpbZ3Sc7nfZBhVz:tXHcEA4z1m46GpbZZBht
                                        MD5:AB75E96AD411C10AC315B1C104BDB58A
                                        SHA1:101AA2C7A353A19DF8005BA093AA3082B0FBB650
                                        SHA-256:7999E267C2C6C051C6CB70E776DEE5EDE2A291BF0383E7767B502F4CFE4D58F8
                                        SHA-512:4A0EEB728E6A512E18DF0CEA8F1321339CE3DC326EC672408A574A4734C825E21D57CC529489458278258B778E06AE98BF491BCFA223742BC8A6ABB9E1DD9820
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=444444&bgTextureHeader=highlight_soft&bgImgOpacityHeader=44&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=loop&bgImgOpacityContent=25&borderColorContent=555555&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=222222&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=444444&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=003147&bgTextureHover=highlight_soft&bgImgOpacityHover=33&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1378)
                                        Category:dropped
                                        Size (bytes):18016
                                        Entropy (8bit):5.083484636552025
                                        Encrypted:false
                                        SSDEEP:192:XRASCrjVnIF5fyIS70EcS1poqZGgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhn:XRdF5fyUE+DS25u
                                        MD5:6D93DC6B49305078CDC92FD8E2F5B068
                                        SHA1:1262493B0C501A3452A430E9726F22E23107F73F
                                        SHA-256:9EF7AB8ACB7D9D64C5DB0FEBB181051F48DD21B16265CA5A42F6997CA87CF7DB
                                        SHA-512:C14F54720D8F01B34D5385DEE986AD013C6608E696D229C159B07EAFDC285DE1A076F81DFA3884DFDCF4D12974E82DDD7CBF07C13361E12452408A40E87A52CF
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=444444&bgTextureHeader=highlight_soft&bgImgOpacityHeader=44&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=loop&bgImgOpacityContent=25&borderColorContent=555555&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=222222&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=444444&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=003147&bgTextureHover=highlight_soft&bgImgOpacityHover=33&borderColorHover=0b93d5&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=0972a5&bgTextureActive=highlight_hard&bgImg

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_diagonals-thick_15_0b3e6f_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):482
                                        Entropy (8bit):6.731455137882688
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+AfHu+wsqBaud0rPo3/HayzS+EELEMPS:X9+vXsa5dH3PzjEELEMPS
                                        MD5:3FB571A70BAEE9CCF436CB7444655F4F
                                        SHA1:FADA5ACBCE5E3417064B121397DD5DAA59EF300B
                                        SHA-256:7767B62C04F6012A35581706342FED2D508337E4E56EEF8AB5AC3A0FD28117E2
                                        SHA-512:73B79B930ED70A66623572758C5E693827133A56BA7BB96CAD02ACADEF41BE9314B9AF15929AD8B139074D19B8538A9EFA9D39121AF4EB32BA36DB0D31472481
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....A....N. P.....`(.{....T...(.A.$A.Mv.;...g..3y.......2y._...Sf9-....?...j.L.&.lj..@......z.Jz.]..*..rW...*0.Z..Y0........5..P...Uz..[........0.Z.&Q.`.5..R.`65.{.J...M.N.....0...S..0...=P...5..P.E.....0.*..m..q..e!...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_dots-medium_30_0b58a2_4x4.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 4 x 4, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):295
                                        Entropy (8bit):5.8403310516544025
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP7TCUyKfp5EJ4/It961yltYDIG2zgN+E8VLEMlVbEbp:6v/7SU9+btFtYczS+EELEMPS
                                        MD5:F18ED3A85803A0A5F7AD022481865788
                                        SHA1:1036BF67D25712B952886365C3C172D21D1180B6
                                        SHA-256:BAA6735F2CABDA61DEBECEDFC1F2D6EC88B80B4D09072E63F513C875DBD3CFFA
                                        SHA-512:1ED7C77032A9B4C26C3EA2380E9FFF68CE9F812E27F85C874A8CB36B4BEA589ADA01337E451D688ED3650C2DD3548B79D2DBEBE69F8B404A7AA1213743C9CD4C
                                        Malicious:false
                                        Preview:.PNG........IHDR.............v..j....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......+IDAT..c..X....0A(...|...E...@.;...~..,............%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_dots-small_20_333333_2x2.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 2 x 2, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):266
                                        Entropy (8bit):5.450950367736609
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPg2pUyKOkp4/Qk3hjsxzgN+E8VLEMlVbEbp:6v/7I2pUEgzS+EELEMPS
                                        MD5:AB212BB03E3F0A9BFC602E66A66A5B52
                                        SHA1:0C670C2D8F309DF83B7D751D203CE1B2BA936175
                                        SHA-256:70D6178C8CC51943FF7BC50F3B5E9532BB5819A38A2C8AA35A07F90FED30AE7A
                                        SHA-512:90B36A53DDE5DF1D845A590AF4670557CE81A7240FA93E65CED9C982694F27B820A65B8E8EBFB538A13D2DA6B07C52356C111D8AFB7C37BC5783224DB0A71A60
                                        Malicious:false
                                        Preview:.PNG........IHDR..............M......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDAT..c46f``b`.....8..e`.P...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_dots-small_30_a32d00_2x2.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 2 x 2, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):276
                                        Entropy (8bit):5.6290628196886745
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP2+UyKfp5EJ4/izEpllIzgN+E8VLEMlVbEbp:6v/7ZU9+J2KzS+EELEMPS
                                        MD5:49BD4C1ECC0B3DE7361A173739B42D09
                                        SHA1:79DF813E194FD54B0FF5815E239E0BB63ADAB343
                                        SHA-256:D5B2FC96836D2CF7D20F26F934CDAF978C59B08EC1F7B321D5BF23EC92FDC744
                                        SHA-512:9DCEC21CE1467B596F63C9D3915CC5FE2435ED5AE2ACC245D6FC1FF852E2B68A325B96AD45FBDD4C00A491AD00421A742AE9FC0F84E2347F10E17BC7F27A1C9E
                                        Malicious:false
                                        Preview:.PNG........IHDR..............DF0....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT..c\.XW.... ..K..j../..,..Z....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_dots-small_40_00498f_2x2.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 2 x 2, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):282
                                        Entropy (8bit):5.635984033684598
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP2+UyKfp5EJ4/8kl7J7FyHxIvzgN+E8VLEMlVbEbp:6v/7ZU9+CN76OzS+EELEMPS
                                        MD5:05D7305DFD9AF99188E21D18C608E250
                                        SHA1:3A7C3BB198F46F3B71A539A73407A75C0B8DF223
                                        SHA-256:49584E9E9A3D8B1D999E047C3D33E2FA534E5CE08A804B02F52624FBE544793A
                                        SHA-512:FA1EDE1473FA1A615173200BE68AD4240FDB5886BC2783E920BFDA0B3687ADD9E8783EAC037737BD613162F0AA943602B06734B9870910A20F9839392614E31B
                                        Malicious:false
                                        Preview:.PNG........IHDR..............DF0....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT..cd`....g``````.P.i*..'..*....D.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_gloss-wave_20_111111_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):3990
                                        Entropy (8bit):7.891474477620868
                                        Encrypted:false
                                        SSDEEP:96:fcZXXXn8g4P6kNt+zEeY1ICwThkhndsqJamy8rApR+7q+S:04P6Zwp1WIndbsgjq+S
                                        MD5:0D7E9BC2B8DB61A4B7A4D55044760EAD
                                        SHA1:00323D927D10A18334079F55B5B1A92AB00FACEC
                                        SHA-256:5240A391500CF005247EBBB2662044AC85EF065BACB88ECA5D297837D733FD1A
                                        SHA-512:BAB006B5CE949D0096648E34C2B290E406111565416E1F2820915EC646364C7643FCD67B61FD030972D9498957DDFCAB9EE3C7FC53CF5CF46BCEA2D461D2C668
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......<A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDATx..].......o.*.%.E..D..!(.i#p1.:./.p.C`.^..*F......l1...c...q..{....9U......\....4..... .9.N..A....t...8..b..@'..... 6..t...8..b..@'..... 6..t...8..b..@'..... 6..t...8..b..@'..... 6.=..k?.k.`m3.Mil..-.G.Q2Z.z.Y..z..m]......}.v...8=Q[...Y{.W. b`.k..Am....f3.Ql...}...%Z.....#.^..d#0.(....:._.S..x...K.I..\M[ .km....M..k.+.....R.cF..6._...Y.....$.z2......f...#F.....y^.....f.ki..iP...R.......q.... .........N....4.".o.4..D......)......r.$G..../..tI-;...H[..1.i...*..2.@.E.H.E.;.iF3;..4..i/.H0/.{..G..>G.....z[d'.0z.GI......#..a.Q.C<j...Hy.s.".6........&Rj...NuS./.k.ZOr]o..4.....}.6...C[.1.....Zoc..R:....K..Q....=.....i.md...........f..A{..{.>..j.......].%.....V..8.|O.:-'6.~<.1fc.9).~.. .98.N...'..b..@'...\.}j....o... 6.^....p>||./..#.Q...\b.|F.U...m...x....-.AK;b.\l2....V.....y.3O.B....n...7.\-.8.,.I\...v^.$.,.y..K~...A....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-icons_00498f_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.738397057708785
                                        Encrypted:false
                                        SSDEEP:96:S3NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:CHm231Nvu+wIqltWOe3nIP
                                        MD5:409DB4EA7A4679B64D9903E558897637
                                        SHA1:A5BC4583C783DF4AEE4C5B234561FB1C8E4C31DE
                                        SHA-256:BB348EFA46AEDEF89A18A0256964A1E17525975EDF9CD442C7E2FD0DD40113F0
                                        SHA-512:A5D76876D39182B924FD93ED3B6462C9FA7378184FBF9D19FB0D91CC0CA1EF7CA8C32054168F5B399EAB2F49AF0487CE4887B2C708579F61C601F315F1A5FD05
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I.:e.R...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-icons_98d2fb_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.778170418989979
                                        Encrypted:false
                                        SSDEEP:96:cNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:GHm231Nvu+wIqltWOe3nIP
                                        MD5:2979CF4F5560012AC1C67573A43D1405
                                        SHA1:13BE8F99080E00991795FDEA751353FA8E75DCBF
                                        SHA-256:1F1D8BD9D4CDC3919D74287BCD9B3C0A7533E5407D05043C0C2F2BF7D1C0F436
                                        SHA-512:21676E992AEE427E3D0A7494B1B8D37E319CEA3FD52519CE8B0D29D2D8489125C6FE9D1A5A2DD494B93523AE0AF56644ADCEABDF8B49EE1F0B56A883817F5142
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...................................................................................................................................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-icons_9ccdfc_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7732597452877
                                        Encrypted:false
                                        SSDEEP:96:qNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:EHm231Nvu+wIqltWOe3nIP
                                        MD5:99AE47587576A1A15CB7B15C67F3545A
                                        SHA1:C6D3E695CAFF3DE7F9EF47873E543E6B0C0FB4C1
                                        SHA-256:4015F92E2862926B030463D1D94548059604B362A272CA12E66E5D0A11600635
                                        SHA-512:FDD3A8A55AB5F59A7A583C5132C30690EBB67882094E0E895189111BF8AA455E703234E2033F05BFFA141CB617D7E48BA6D8825A069C1874C1136DB24AC99E28
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...................................................................................................................................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36540
                                        Entropy (8bit):5.279669592134456
                                        Encrypted:false
                                        SSDEEP:192:10OW0XXmLjVnb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHuo:rXmVnb/+vaW1e07qF5fyEECDS25ulak
                                        MD5:008B2CC14D63BAAD9AD3ED34F27BA400
                                        SHA1:978BF40F9CA08495E0DF2150890AAA20B6BD03F5
                                        SHA-256:9CC15CFC0AF0DEA3577DE02C4C5710868B84DA3D32FE8A5A39EAE1E87C336DA7
                                        SHA-512:7363DB6DE432B0A6F763FD05BB6469D6FCCAFFC7DDE22684469DA3D336AF58663F93B69601682D8FE4FBB7817F1714AC29A963FBEA9D993A9085B7849B41AE10
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerRadius=4px&bgColorHeader=0b3e6f&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=15&borderColorHeader=0b3e6f&fcHeader=f6f6f6&iconColorHeader=98d2fb&bgColorContent=111111&bgTextureContent=gloss_wave&bgImgOpacityContent=20&borderColorContent=000000&fcContent=d9d9d9&iconColorContent=9ccdfc&bgColorDefault=333333&bgTextureDefault=dots_small&bgImgOpacityDefault=20&borderColorDefault=333333&fcDefault=ffffff&iconColorDefault=9ccdfc&bgColorHover=00498f&bgTextureHover=dots_small&bgImgOpacityHover=40&borderColorHo

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29509)
                                        Category:dropped
                                        Size (bytes):31287
                                        Entropy (8bit):5.2226618941796215
                                        Encrypted:false
                                        SSDEEP:384:rXmVnlcR8lOXHc11evMf+8mzkmAW+4x6GpCqISc7nfZBhVFWGc:sOXHcE58mz1AOx6GpCqYBhM
                                        MD5:2305D06C48CA0D210D8A3DAF72019233
                                        SHA1:278E6B52466C2A13308D94DA327DC20D4048B2E6
                                        SHA-256:B5914589E58247E40B3D224AAB415A049674B5EC805C13E6A0D41F871FE9F9D5
                                        SHA-512:8466242B348C59A296274306215CB787C0E4D55944390851E0D141D7C8C7DCA092CCE847E5983A4F9E1FE76EA77BC79955396714C722798ED995A77D82527D33
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerRadius=4px&bgColorHeader=0b3e6f&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=15&borderColorHeader=0b3e6f&fcHeader=f6f6f6&iconColorHeader=98d2fb&bgColorContent=111111&bgTextureContent=gloss_wave&bgImgOpacityContent=20&borderColorContent=000000&fcContent=d9d9d9&iconColorContent=9ccdfc&bgColorDefault=333333&bgTextureDefault=dots_small&bgImgOpacityDefault=20&borderColorDefault=333333&fcDefault=ffffff&iconColorDefault=9ccdfc&bgColorHover=00498f&bgTextureHover=dots_small&bgImgOpacityHover=40&borderColorHo

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1355)
                                        Category:dropped
                                        Size (bytes):17886
                                        Entropy (8bit):5.081970292059026
                                        Encrypted:false
                                        SSDEEP:192:XNXmLjVUTDziAF5fyWy2EcA0prtOIgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhdlR:XNXmVgF5fyEECDS25ulak
                                        MD5:2E88AB19BF92243A51E13D0B6CE0EE7F
                                        SHA1:AE106A36C01FB6B08538B69AF49B60BB4E7823C4
                                        SHA-256:687AF36230D585492083648BC22EB68A1E27990716B420BD1884415A9D74D888
                                        SHA-512:4E4CB4D91FCB5BF711E295D32529FD45FDF29AFB72029A30CEF224BDA53C294EA92EB2F224B1769E7BB10E64AE68FF0B036CD282BDA702FE88AFE1D6114E4901
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerRadius=4px&bgColorHeader=0b3e6f&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=15&borderColorHeader=0b3e6f&fcHeader=f6f6f6&iconColorHeader=98d2fb&bgColorContent=111111&bgTextureContent=gloss_wave&bgImgOpacityContent=20&borderColorContent=000000&fcContent=d9d9d9&iconColorContent=9ccdfc&bgColorDefault=333333&bgTextureDefault=dots_small&bgImgOpacityDefault=20&borderColorDefault=333333&fcDefault=ffffff&iconColorDefault=9ccdfc&bgColorHover=00498f&bgTextureHover=dots_small&bgImgOpacityHover=40&borderColorHover=222222&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=292929&bgTextureActive=flat&bgImgOpacityActive=40&border

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_gloss-wave_30_3d3644_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5999
                                        Entropy (8bit):7.691482100292732
                                        Encrypted:false
                                        SSDEEP:96:fHClGlTr0BkxPKNexG1FUtdLdkQZVRm35XN4eyVI6yYGcTU/gF6FrM4B98625srx:PCMhxPKydkcVcBN4eyLyYGcQ/HpM4B9L
                                        MD5:F36FCC39931731535915E2DDFDBF3947
                                        SHA1:60BF6CD036594601733C7E8E12CD22033789B2EF
                                        SHA-256:3A11AEC8A7D12CBAEE309A9D4C545F8EB64DE46E5C24BFDA11119C40FF94EA46
                                        SHA-512:A513886D3B211500FD06AA7AEEE9073D0AE843245B6613DF334A9336FE651096AFBC23EDE8FCEC7E2E361FB86F63B441FCA6DE26E63115542FC05048099ED64E
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".......sIDATx..].%.u.{n.".K.^.. .@6....|$..#.Bv%y.rd.F`... !.D.B Y..../..XCp...^.yI......c...=.!.!......<.......OUu....A.[]u..9U]s.....9...}=.........................+..w........;.............`..........pp.....X.8...............V........+..w........;.............`..........pp.....X.8...............V.....a'..Eo...g.l..,....y..OS#m.4.:..r...o...(}].qy....dVQL.Q.Rii.)..U....|}.b....k_.%_+..9kA.m..x..Ea/....j.=1_..=.*.{.I..Gd.....UUb....}...G.t......*........2.zg..ghk9?./W..........p....$.=.....'.B..E.>.8\,.i.B...O).iy.y'5m.......C....;...;..Wo.Y.i..........!...}.|........c.U@&.......Y..;...........*.......pp.....X.f.<\o...U..^h.....Q.];.>};...Y...u.W1.bz..:.J*9..E.G.].!.m_..R'z.s.+.gN.^e...YV.+k.....j..=..]..nJU.){.R-...........(...{.~.K.{z..!..d.K..kA?......x....9..d6-..J....;.>.....a.....m.f'.....t.w...Z.g.m.,{-...y.......&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_highlight-soft_100_dcd9de_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):400
                                        Entropy (8bit):6.509967114205884
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+mu/aCDPqNiGwkWXzS+E3V+2EMiVw9:no19+myzMiLXzjE82EMr
                                        MD5:5D491F7B87E945DF741EACB3D368ED05
                                        SHA1:E85A361D1DEBCAB83DE799F29ECD4754A518CAE4
                                        SHA-256:902CA5DCEB7F066FD3830E81AA40FD261A4BF4F11852D259F557B88051C4F376
                                        SHA-512:E6FF0037B706294D556030C4DFE04BA48165F8B2B233BB5BA5C2BCBD71013C466175207EB1C544D9370930D7F42C2527185EF873E9D7B512085965A2347DEFB9
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..;..@.........A...ZXY...z...6.H$..iu%..~...'P........o.;.$.o.R.Znt;...i...1ce.$L....h..:...x..9.h.....7..>l8.[..c)..7..U.8//s.eQ..._.qx..Ml:.......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_highlight-soft_100_eae6ea_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):431
                                        Entropy (8bit):6.629498745211216
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5Eil1m0UFAQNy7VtY70PkBJyj2zgN+E3VKF2EMiVAVTp:6v/7WogU9+2s9ynY4szS+E3V+2EMiVw9
                                        MD5:0833FE23D64DB51677CB9F8BEF35E10F
                                        SHA1:61528D6334E88224E13B309F524CB01C5DD29871
                                        SHA-256:F08B09D7F06D2E57475985191A7EED6046022A218B7238E8F51D43E786E34E18
                                        SHA-512:334C81EDF50FF9A61C52AA8DEE7DD4EEEAD8A652377FF037BDDF36C3B53D97462A820DA82E04B81FBABAB109D6473222962F7F8E16D157B75C25389FA078131F
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..!..`...}.@`..y....6.' AQ...%..w0p.....&..GD....g.+.fz.>.[...RCB....$.H....&....)z.;..T.^T.e..e.G.s..^.Cv8$..p.F{...#C.p.Z...=^.7.+C.*c^.x.#!b...t[....1.U...!.\.oW.q..bY`.!.;W...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_highlight-soft_25_30273a_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):420
                                        Entropy (8bit):6.606028187820867
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+tSksqcRcltd2d2uSQCGyzS+E3V+2EMiVw9:no19+tXsqca9OSQpyzjE82EMr
                                        MD5:C1910C93E28B98D5AE0B2F2B1B04EE22
                                        SHA1:F36314A03DEE387C90EDCDD88AE5C6BB1CB484C4
                                        SHA-256:65B5314B6F5D2399314FBFF4617560ADEDF496B221E15CC9B5D4B92595D2B28A
                                        SHA-512:9BE84A7D68C0E129863F4170B8B6CF0420A2B530703BBA5273AE220455EBCC2F75E755E9256C8EF7AD657506FDFABC2AD82B852FEC3F7DC33CB4DC1C003C1E9D
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(....`....0N........D.-........q..................0q.....+.8.-..MEDD..g9.EY....N....Bi.a&.......)3.=...L..(V.`..b.Ee&..Vxhc..H..3Z..9.,.w..p..Q.v.a ..A..~./e.d.z;E...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_highlight-soft_45_5f5964_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):405
                                        Entropy (8bit):6.462769543492536
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+yI9YAi0AaGztnzS+E3V+2EMiVw9:no19+IAibzhzjE82EMr
                                        MD5:88961029455F0C3A5066CB34D7814023
                                        SHA1:D475886D45EECE8598892B5144F569DAA93114E7
                                        SHA-256:D8AD7211C34EAF56349C6D629B4C740947E0F774E2693216155BC820AFC6591D
                                        SHA-512:19320CC6EE4E69F57846B847C55B837C2B17409CD019DB1B9108AB5D9437C89017FDD73051FCFC676BC56599B54610309A18131BACEFEC5963E65012884D5F90
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(....A.D.&G...8:....k....6..zN.. .{..g.X...3.M.4...%..dl...k......v.+...^NG.s..\.a.V.Y..g`.c...{..`.)'./a,.Mn..+.....8)+.6z...X.j...zB3M5..K?...Zm....L...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_454545_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.925434318681863
                                        Encrypted:false
                                        SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                        MD5:5C3BA680CC34CD9B30855C180474A152
                                        SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                        SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                        SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_734d99_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.778147156719075
                                        Encrypted:false
                                        SSDEEP:96:kNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:uHm231Nvu+wIqltWOe3nIP
                                        MD5:049AE0FA0D5115E50A85DAB704272EE5
                                        SHA1:0596A3E153C7F8976A78553D6E3BAF492CA1C81E
                                        SHA-256:584A79C0AC285D669F287C6AC494AA4549818231CA4C7C37120AA5C872291221
                                        SHA-512:CD4FCAF571532AE4F74344BC0261B748482E6CD84AF7FCB8EAF1A71A8A7D823A305042398581A7FEFBC9B764A10B6BBC7B21E538A4E534560094FCC9F5571800
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEsM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_8d78a5_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.779787835398036
                                        Encrypted:false
                                        SSDEEP:96:3NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:vHm231Nvu+wIqltWOe3nIP
                                        MD5:1388573ADFE782CDF788544BC92118D8
                                        SHA1:3770D75FA62E144B7BC9ED4B1703D52733A99B85
                                        SHA-256:46F15CFD2AED013ABC792664D8CD78E0A7F6A76ACEB31A4D4C4688CEC46610FE
                                        SHA-512:1D396D2D3FE96FC48413178F9A39075B52A4A8A6DE5D9220484585F096D39ECD8FF3254D0A630F583E1067D0A51C24874D5C2D2439736393AE7548648F31DC35
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..=.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_a8a3ae_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.778042983270137
                                        Encrypted:false
                                        SSDEEP:96:QNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:iHm231Nvu+wIqltWOe3nIP
                                        MD5:EF31D50172093B1F64CFADF1B8292CF0
                                        SHA1:0E1173B04F2A1888F5C829179DE59B479F6944AC
                                        SHA-256:3D0B1E030A2186F8A5D5FDF83C902908AF76035E43FE2ADC989627B419D226A1
                                        SHA-512:3FCD547B4540D4C09F7D9843386DA1B1088FEB5B7E3D219531D7513FA377E75478A74DF58D077AC5BFB864321B31007EBBAF038C9F72732C4B016CFF8A3C1BBF
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..................................................................................................................................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_ebccce_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.775735413327992
                                        Encrypted:false
                                        SSDEEP:96:HNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:fHm231Nvu+wIqltWOe3nIP
                                        MD5:6F8710413AA2B910A26426826BB516F1
                                        SHA1:DD3286F638EAF535A1797A12DF194195A9E98484
                                        SHA-256:8A9CD6D04D46342763433F96D2B96B14C73F39AA5183D22A68C18F5BCFCBF929
                                        SHA-512:5E8201C9140EA10C5951CB4D5299BDCF9B893068250C5730D1FDFB35D567DB37D304B0BBC8C6842244319D092C563514E40AD2A5398F749D7EB7E0D600B31EB3
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36594
                                        Entropy (8bit):5.280448617485699
                                        Encrypted:false
                                        SSDEEP:192:10OW0o4b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHCqQPH1E:U4b/+vaW1e07CBF5fyD3ErDS25Y
                                        MD5:48B634CC145D6374F451520CC9638311
                                        SHA1:D59AFEC5961C41885AB365E29005B02730DAD09E
                                        SHA-256:4528E977EAE52058B750F9D5352D814E29A2BD8EDC1BCD329402E67E68B295C4
                                        SHA-512:8CD14F776D95F145672B6E1A0CA1C44804AEB43F3F4EA72BC7AFF758B587146D5134D2D451061E57B69148224BFE11CD5AF14A5EED0A5AE9673B9C94B91CC4E9
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=30273a&bgTextureHeader=highlight_soft&bgImgOpacityHeader=25&borderColorHeader=231d2b&fcHeader=ffffff&iconColorHeader=a8a3ae&bgColorContent=3d3644&bgTextureContent=gloss_wave&bgImgOpacityContent=30&borderColorContent=7e7783&fcContent=ffffff&iconColorContent=ffffff&bgColorDefault=dcd9de&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dcd9de&fcDefault=665874&iconColorDefault=8d78a5&bgColorHover=eae6ea&bgTextureHover=highlig

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29532)
                                        Category:dropped
                                        Size (bytes):31350
                                        Entropy (8bit):5.223859065827434
                                        Encrypted:false
                                        SSDEEP:384:U4lcR8lOXHc11eveVazOm0+4l6GVEPGSc7nfZBhVk:IXHcEeVazjgl6GVEPqBhm
                                        MD5:361D1D4C0FF0AEFAE3F9807DAE3572AE
                                        SHA1:A2CA23A18D57C9800F0B4FD03D3169DB4FDE8DD7
                                        SHA-256:7C6C400B8D286B59DA3CFC10E53A1669F340F90B4CD48515B9FF7EF8349E1FAC
                                        SHA-512:7FC0D21ACCF6E3FB4776D8B37B72754FCBA43C8EF26BB4FB9748A77C0930FF62E7540814AF742F10134185682DA3FA856B16B1DAFB4F65ADFD90B469CE32C9AC
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=30273a&bgTextureHeader=highlight_soft&bgImgOpacityHeader=25&borderColorHeader=231d2b&fcHeader=ffffff&iconColorHeader=a8a3ae&bgColorContent=3d3644&bgTextureContent=gloss_wave&bgImgOpacityContent=30&borderColorContent=7e7783&fcContent=ffffff&iconColorContent=ffffff&bgColorDefault=dcd9de&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dcd9de&fcDefault=665874&iconColorDefault=8d78a5&bgColorHover=eae6ea&bgTextureHover=highlig

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1395)
                                        Category:dropped
                                        Size (bytes):17940
                                        Entropy (8bit):5.086626971912176
                                        Encrypted:false
                                        SSDEEP:192:XyHqQPH1LBF5fygdwWmEcQEdBs7rgmB0iBfT9RhS2wV53skuMaaSQhQz0iIh20:XyZBF5fyD3ErDS25Y
                                        MD5:6D58605EFA0BE1BA65372D9CCFD510CE
                                        SHA1:AAE121EC1FA89DE991FCBEA540AF8E423FEFEEF9
                                        SHA-256:06247389586C2705B4DFDF601C751B04847EB3641E3878F6E97C230C121AD4DD
                                        SHA-512:641E17A8E793D1902C9BB6EB6B9B04CE4986E5C025154066D3C0753DF874DF0CB11F6C06186475DAC252BC44B974DFE96CD14392F4A56414E5930BC70AAF6860
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=30273a&bgTextureHeader=highlight_soft&bgImgOpacityHeader=25&borderColorHeader=231d2b&fcHeader=ffffff&iconColorHeader=a8a3ae&bgColorContent=3d3644&bgTextureContent=gloss_wave&bgImgOpacityContent=30&borderColorContent=7e7783&fcContent=ffffff&iconColorContent=ffffff&bgColorDefault=dcd9de&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dcd9de&fcDefault=665874&iconColorDefault=8d78a5&bgColorHover=eae6ea&bgTextureHover=highlight_soft&bgImgOpacityHover=100&borderColorHover=d1c5d8&fcHover=734d99&iconColorHover=734d99&bgColorActive=5f5964&bgText

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_diagonals-small_25_c5ddfc_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):400
                                        Entropy (8bit):6.3943414419884546
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+qFCYR2oQApEsHyszS+EELEMPS:X9+qFfgoQAp/HyszjEELEMPS
                                        MD5:E28D9FDC77D1CABE522D76F6A8431E2F
                                        SHA1:6EBF1C38D3C4264DE61AB7BD15432E8615EB39A3
                                        SHA-256:9A86ABAF12D82902252F5D18B7EE2972C9605FD507AD279E22F1F9EE53F58599
                                        SHA-512:AF0930A931FDF089D67527A60364B2A088B704C72ACD9D182CFA65F841B89850B39DD7098F2DD3A0F2305AFDACF22B611921FF3257AB2099655BA7E7E71A6B5C
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....0.DQ.....]PL.`2f@1A%#.0..%`.......y!..K.^k......=..>).?..h...{w..).?`......0.1..1.a.c...vH....K.0.1.a.;.h~..%b....0..R4?...1../....y...M....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_diagonals-thick_20_e69700_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):475
                                        Entropy (8bit):6.752318098655858
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+b04gBOdOrEBOwZRHRg8iPs4OQ+Z+yzS+EELEMPS:X9+bCBBIBfxg8x+yzjEELEMPS
                                        MD5:A64F6F201FC8C651C5C88BB4035CC0EF
                                        SHA1:24FDBC731401B085F7C115819C797E83B45B8945
                                        SHA-256:2DC875A19C0884466AC284544BA2E1C6F8D64B0A5C070AEA8837718DC4E7239B
                                        SHA-512:54BDD1A57E96F432353457778015D759311A0F5687FD088CE1F6C9A7FE25F2DBB49D4F8D013F551B55B5BF0C5F5E8DF6E24EF7909E06AC3185B49F56D7A68955
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....0.F.8.tt..$..:3.g.v.b.J$.....>$.{...8.../=....>......L...q........PM0.Z.......J..m.k..j.^.K.\.8:U.&0...&Q+`...S..0...{.....D.*..G\.....H....Ku..S.`...L.V.<...R.`65..@Uc........&Q+`...S..0...{.....R.N.Nu..S.`.U}..>.........%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_diagonals-thick_22_1484e6_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):467
                                        Entropy (8bit):6.551733813034693
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP2gUyKfp5EJ4/KaMpTYOvJE+SwNrzEIs5lwKSlQdfNiCxzgN+E8VLEMlVbG:6v/7egU9+LHX9REIUSIiCxzS+EELEMPS
                                        MD5:E3B17CD6A93A1119D1974390B693906E
                                        SHA1:61071377D2C6B7CB7A9F1569D58BB194BDE6A8D2
                                        SHA-256:70EDE93717F645F1BC66F67CAF12B885ACBE60DE378F61088AB2B607F9CB92BB
                                        SHA-512:EB251150CE1DB402F7F5E75BEA8748463BFEE4FC1E2E46108691B2C4973C6FAB4E0C05DD35F11D5852572F4E07EE869AF746B6D84B3ABE320ABE16DF5452DABE
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....A.........(.^h....A).`. f.&.......zf....]N...95....s..9.....^.gw.Cm.....M-..T..P..C...8;....A.....0...S..0.Z.....:X.j.?.3R...y.apvj....I...Gm.....M-..T..P..C.~Zt...D.y.&.J......@u....:..E.....0.j..".....m:...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_diagonals-thick_26_2293f7_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):464
                                        Entropy (8bit):6.63752038608698
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+RcLO80YNJoroGsPoGs0j2zS+EELEMPS:X9+SLu2W5sPoGsQ2zjEELEMPS
                                        MD5:1E83CBEA9DB15BC529ED10025F161EFA
                                        SHA1:5C10F56CC53DA52E4E781D4ADA03DF32DEBA4250
                                        SHA-256:A9AC1DB351456F78CED0DBC0B1A4EF42978AA13FDA297854320E92532E185D2E
                                        SHA-512:89D18E5880F26DCA7C014221993920279289D6AC4047ECFCB98D53480BF9C088D1945D0A7E2AB0AFAD9E64F6CF7A7D7033D906E95F86EFE3667670DFC8E3A6D9
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh...!..A.D.e..,..58+..*Xn...!.i3.tf.A..T.N...\...{;9y...9.sz...>z...Y.....M...T..P..C-..pvj.C`.u.L.v.<...R.`6..+P..C5.......H-=..K...S.`.u.L.v.<...R.`6..+P..C5..u.i.C`....Q]0......X.j`...u..O.N...S.`....2....#.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_highlight-soft_100_f9f9f9_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):325
                                        Entropy (8bit):6.042377501793925
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/nhUoI5s0GbzgN+E8VLEMlVbEbp:6v/7WdUChUT+bzS+EELEMPS
                                        MD5:8B553361D5B0873A7CA47A8431F411FF
                                        SHA1:AF4FF9CF0FAEF9F03F793AB10781F29A8A01707E
                                        SHA-256:07CFE84A9D3C68A80CE8C878E53A092E25346F43CDE426582958F85A8210B025
                                        SHA-512:95D90602B49B61C5A5D6C09D6D14DD17A241E1B275C9F619A597B6524B993272C0E5D6F2F225183BC1BF523CE49F5FFA9129610AB2656B04E9FAE1926951BEA3
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......MIDAT...1.@0.@...qyw2.K-$..3.*\.,y.x...*Y...#.E.D...'J.(3.@.%.&.dY.=.........xI..C...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_inset-hard_100_eeeeee_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):314
                                        Entropy (8bit):5.943498819236378
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/Akl27opeLDvJX4wbvzgN+E8VLEMlVbEbp:6v/7WdU62A8Dx3bvzS+EELEMPS
                                        MD5:ED49819A8691DD27D0D1515C1BA3C23A
                                        SHA1:F9E91232D206E59CC1132312B9B4C0040A3F39CB
                                        SHA-256:5239FF76C9F2A9F6827A5D8C90632E81B67C64B2A326A38FB7A10CED6A4DAC78
                                        SHA-512:3E7D5BC375E901235D05346A52B9C1A5412D6CD8659409C479C92E4FED04B4E56005FA2DCBF8BC08D3BC8C7BF69F45A3B091E0403CB4CD36BAB2AA9A2AB71A31
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......BIDAT..cx....a`..{c..g..W3|4e.$.......&..L.....31.c.!..c3.O)&...t'....|..D....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_0a82eb_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.76566668388668
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:9FF8528D9DA88808316D02CDECADF673
                                        SHA1:FA7FAF603910CF3FB79B646296F154F23BB837F3
                                        SHA-256:3892107CADDFAC58F15140C2CA6FE0D95C94650D1CE16E6D69529A88B6FF14D5
                                        SHA-512:5B5EA2C588000EA657C36AAE88D83FE9DFE176D01EAFC2E716D5F41577C5F7493FDD5AC517A06628C528133540F32C69D89D4E012302EDF169A7167F1B7B10ED
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................).\<...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_0b54d5_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.771562469506502
                                        Encrypted:false
                                        SSDEEP:96:VNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:lHm231Nvu+wIqltWOe3nIP
                                        MD5:80120F22D98CA56E3B581A6F868407AF
                                        SHA1:C892F39EF3F4663AB96E2A8532136737296F981C
                                        SHA-256:A4749B3B9273C0C4309EB52353F96775F206C7CCDA35ACCF4EF06C049EC86FC0
                                        SHA-512:989838792182C51C915CDAF7F99944B4EC657AE6C96F9471CDFB6DD756E2FFCF775355A59790DAC928EE671E9A7BE111ADE64005D8A61F32277ADE272D127BED
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..).U...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_5fa5e3_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.772839275823038
                                        Encrypted:false
                                        SSDEEP:96:pNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:xHm231Nvu+wIqltWOe3nIP
                                        MD5:A895567FCD9642A984998239014336E1
                                        SHA1:46F2F8D8A7E5BA4C43BAB76C59B31E97ECD097A7
                                        SHA-256:8B0A0E3F015B5284028E49D5F648A713CD84E590A92B264E5EF2B057F9BFC480
                                        SHA-512:8EAB4F177B3DCAA8FE64207BBD7CED21C8C5CC85E6A0F32DFC2AB041EC5200E2FB060E29CBCF60102DB9FB9F9B003AEF058596E0FBAE2371C4D6E559BFD82386
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE_.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._..^.l....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_fcdd4a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.76837161257278
                                        Encrypted:false
                                        SSDEEP:96:wNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:CHm231Nvu+wIqltWOe3nIP
                                        MD5:9A3D720517D8EA32ACC5AD2E4DBA0CC2
                                        SHA1:B6F591E702A734C68CFD706BEF5EEF70054D7155
                                        SHA-256:0025AC75218AA091A3C505338E6D11CC5FE23FCCD14D325AAE8E5382383027D7
                                        SHA-512:F5EB071B5CBA7E27AA249B257CDE5E6320AECB7181ED941309FE2BE97D68B5305248A4584968201E1D318C4D6AA56E5F1B5E47A3E994C8CD96A646590073F4A0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36698
                                        Entropy (8bit):5.28035327558939
                                        Encrypted:false
                                        SSDEEP:192:10OW0rjJZtwQb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHC6:LJDb/+vaW1e07s0eF5fyjEDDS25ST
                                        MD5:F351054A1B46BD928E59B13D030E6B4F
                                        SHA1:3EB7234578BAB7419832E0A3DFC86C75ABC894A4
                                        SHA-256:57CB76A47FE436DE2E47EA17A92AF89654703B9EECA92319785DCC005397A8A4
                                        SHA-512:2CC409B551AB6FB01C45F02C90A9F31E43C23E3C64FDAB66FFDAC4D0ED94858F0F0EC9BF5FEB5DC48424592E06F8D2C14B0F80755BC77D6A0A736744649740D8
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=3px&bgColorHeader=f9f9f9&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=cccccc&fcHeader=e69700&iconColorHeader=5fa5e3&bgColorContent=eeeeee&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=0a82eb&bgColorDefault=1484e6&bgTextureDefault=diagonals_thick&bgImgOpacityDefault=22&borderColorDefault=ffffff&fcDefault=ffffff&iconColorDefault=fcdd4a&bgColorHover=2293f7&bgTextureHover=diagonals_thick&bgImgOpaci

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29612)
                                        Category:dropped
                                        Size (bytes):31432
                                        Entropy (8bit):5.223109584340976
                                        Encrypted:false
                                        SSDEEP:384:LJDlcR8lOXHc11evMbRlzkmm+4F6GpzG8Sc7nfZBhVOi:L0XHcEMbRlz1+F6GpzGcBhr
                                        MD5:4702538DBCFAAADC53257EA73B3C9778
                                        SHA1:FA6B5D67DE133FF4A47C8D48E216E326A199F99A
                                        SHA-256:70B2BF6325B71F6134DD87CDE2982BC5087F0124E377F78F4B3891046870055A
                                        SHA-512:5344D6C05D9498813DF028790E5FD179264BFA9452CA8031A142380F475879380DE8EFD272F983E261D71CD4B93733B013D95D227C03C9E0C5FCDF4EBE81D9C9
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=3px&bgColorHeader=f9f9f9&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=cccccc&fcHeader=e69700&iconColorHeader=5fa5e3&bgColorContent=eeeeee&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=0a82eb&bgColorDefault=1484e6&bgTextureDefault=diagonals_thick&bgImgOpacityDefault=22&borderColorDefault=ffffff&fcDefault=ffffff&iconColorDefault=fcdd4a&bgColorHover=2293f7&bgTextureHover=diagonals_thick&bgImgOpaci

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1397)
                                        Category:dropped
                                        Size (bytes):18044
                                        Entropy (8bit):5.085323780214413
                                        Encrypted:false
                                        SSDEEP:192:XVjJZtwZ7HnoBp51kF5fyc0aqEc2WpA1OIgmB0iBfT9RhS2wV53skuMaaSQhQz0N:XxJS0eF5fyjEDDS25ST
                                        MD5:EF0D1841B2D27EE513B7F063E3BBD504
                                        SHA1:22BB0182FB7C8080948EEF969F33513E17591B90
                                        SHA-256:F936DFFB4243444117334CEC80EECE47DD8C38AF820AA4ABB2E43133CE69A427
                                        SHA-512:3B83A89A2465452B628D807115DE1831CDB99778AF5107D94EDD73D662C287B5A193B7714FE3A3EC2B8CA23278C003CCCFE85EA5DC82B28B2D88431C8F4B686C
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=3px&bgColorHeader=f9f9f9&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=cccccc&fcHeader=e69700&iconColorHeader=5fa5e3&bgColorContent=eeeeee&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=0a82eb&bgColorDefault=1484e6&bgTextureDefault=diagonals_thick&bgImgOpacityDefault=22&borderColorDefault=ffffff&fcDefault=ffffff&iconColorDefault=fcdd4a&bgColorHover=2293f7&bgTextureHover=diagonals_thick&bgImgOpacityHover=26&borderColorHover=2293f7&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=e69700&bgTextureActive=diagonals

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-bg_glass_65_ffffff_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 1-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):265
                                        Entropy (8bit):5.584405453257474
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh3EUyKO0klyjl2XIzgN+E3VKF2EMiVAVTp:6v/7J0U0l3XIzS+E3V+2EMiVw9
                                        MD5:8EF0673B1B97B64B47D4AB54BAE5793D
                                        SHA1:C5C918B8003EC9D14A197DC9F9E0EB52F14E0CAE
                                        SHA-256:3D59D264A71F5FEECC7A8D9E4DA1B0439FBE0C029AB6ED5F5FC4EA785212CBAB
                                        SHA-512:A08439B5B19E25B6AD0298BE84BC924566354A388D0F4F75FEC63EBB87594DA00D15AF608A661B1451324B5B768E69041CCEAA29FCA829FCE2597AAB3B0C4A74
                                        Malicious:false
                                        Preview:.PNG........IHDR.............G#7v....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME....."........IDAT(.ch`...p....h...4.i...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-bg_highlight-soft_100_f6f6f6_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):330
                                        Entropy (8bit):6.145631819865785
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkjwFFRtIs7wJSOQ2zgN+E3VKF2EMiVAVTp:6v/7WdUpsRscO3zS+E3V+2EMiVw9
                                        MD5:45ED73FE52DAF16B2D3A0E72662479E2
                                        SHA1:76FE051E93E4508E1FD918028DE5B68900BAB964
                                        SHA-256:1B789CAD6E5512F4EB6B3543BA96AABD5513DCDF944218BC59BB4E81811C4EAC
                                        SHA-512:BE8236401084C0EDD5D169A208C5C686F7B8E1C24E0C750B8E590D8940DF6576262C839822E613E134608F6B79E615C341F7A25C365E6A97B1FCA7B66B0B330D
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......RIDAT.....0....- ...\........p.$&.....=8.I.D.+...X.L.(.p.(.c.q..]xa.....RO..n..\..........%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-bg_highlight-soft_25_0073ea_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):393
                                        Entropy (8bit):6.466032240390623
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+wTJ4PMnmAV3XyzS+E3V+2EMiVw9:no19+wTJ4PJAVHyzjE82EMr
                                        MD5:D8B3965B9A0F738201E2ED73842D1CD0
                                        SHA1:88047653F0BA0170C890D7B4BFE154D3B0D0AA37
                                        SHA-256:3F5E8DC44FE61C8CF47056EB6A048CC6C33421F62323D05C41DD1CF785AD1613
                                        SHA-512:6C6DB70787ED33DB38398064ED44AAE9DB86329A62D05FABBC300CE328CAE5ABE48AD57192EE84D9AFFF6BCE9EF857058156B9DE9BE4E5030C4A7F5B96366AA4
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..1..P.CC.:{........^.].....^..]>B..E(....Uz...GBH Xm.j\......W<..k'.A...]"Q{....."5!. 't.....0.h))...>.B.g..H..".s......Y{...p.../.8.p5`.p5....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-bg_highlight-soft_50_dddddd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):339
                                        Entropy (8bit):6.224470981713993
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkaWlvnnH9CILkn3Z00g2zgN+E3VKF2EMiVAVTp:6v/7WdUldCVC0g2zS+E3V+2EMiVw9
                                        MD5:274D0A867B4B7383B8F00DF1ABF31C97
                                        SHA1:9EECAD7F83B31AB8D6737EFED4F0EF0D02336198
                                        SHA-256:A59969DE2C0EB56021CB423D2AEAE22655A2CF4B0F08E5D79FA2F207C70AC812
                                        SHA-512:DCA724499AD621A631A7EB2AD2CB372D691CA5F8187321DCC356768175792519ED6BDBAFEE5722305A8FF7528D949F852ABB132EA1C4212770F56CC3317B492A
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......[IDAT....@P...'.FI.1...@F`....{X....&.,.....g*..%kE....{.....k&.X.Y...J.G..[8|,k.c.d._../......3J...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_0073ea_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.744729627550153
                                        Encrypted:false
                                        SSDEEP:96:FNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:1Hm231Nvu+wIqltWOe3nIP
                                        MD5:D41835FDF53408D566DF927F3643A838
                                        SHA1:1C5AD08E530026EFEF2F3F16206C2C174ED6A0C6
                                        SHA-256:55131EBC9D75A319E819963134EE159BEE69FB1BB273B66DC6ADA30BB6BA8825
                                        SHA-512:C302E3D192884847D2146F628AC69E77412B35786FE8C4EB27FE307C02C4702C5E99A018D0BD7D7CDB66CEAB8056FBCACCC22B6C32FA76D4751EC86119024074
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s........ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_454545_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.925434318681863
                                        Encrypted:false
                                        SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                        MD5:5C3BA680CC34CD9B30855C180474A152
                                        SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                        SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                        SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_666666_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7111
                                        Entropy (8bit):7.928455943008907
                                        Encrypted:false
                                        SSDEEP:192:eMzXuohHXyFN1Ce1gydd84kWORcDrbeq3ek:79HXk1t1gMd8WOkrbeUek
                                        MD5:D779CF92249EF61590F0B6FA32207423
                                        SHA1:5D0223055783B026D13CCF508FD54317B030981E
                                        SHA-256:18257A1FC35E3B8C129E2EE60DA4B617703FE80E43F8D8F3052614BF7AA8CABF
                                        SHA-512:440349B6C97F034C635D731A128EA0A637867EA971631B7A0F4835EB92FD2B7F892B1AFB9CAF78681FE36EACAC8C179793159A29A2052B0F561295C359B31B36
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.f.\._....tIME.....%...'E....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>............d.5..x..^.../.2.........mV..&.@..`..MX9......$)...=.,...0L.L...}.0~z[.....J...5..S.#.G....p_....I;,.:q! `.X% 0.\..C. ].H.....B(T..(..R....o{vX3.)...........6h.>...XhN.^.4.Ab....!CPz%..Lm0..m...m..n....m...9.c.....].=.UL.W..W7..)........6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u.....(.#%$....4`.*.3h...5m..m.......5@.. .~5<.e..........n.oF...|..d{...U.^@...>]..L..-oz.....e..%PE..f......$\..')y8J..^k.._9&.t.;..o2.:....A.......@........px.h8..4..7..:....._+-..s.E.K%.2..5..UA...(.<..`......+P..3l..X..S..G..n%p.U".YR.[..........R...q._`....P.5`..Y.BKl.5b)....Z|.......t.Q.i.E.. Lc.J..t.S...Ch....Jgn.b..(;...Z.-..tVk.n...R71.%.5`j..i..@/...uq...4s.h.`s....... ..]&.Ua.q;].A.....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_ff0084_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.741874689095492
                                        Encrypted:false
                                        SSDEEP:96:QNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:iHm231Nvu+wIqltWOe3nIP
                                        MD5:CDA9229A0065C60B446D7F7649A66990
                                        SHA1:FA668D67BE21B2B327BA98A8058ECC1F2C0FDF99
                                        SHA-256:03E5843431B1363AECC079313E1596ECA5B159193151B2B185CD6940FC8F33B3
                                        SHA-512:8C9DB2836B8EE3C4FB7492FEED43A66B997A9C1432264D91EAE7864921DADD297FAA78650507DD5B8473193A67A4F57C8E77D08A3E50177A29FF6FEF4C864E6C
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................@......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36444
                                        Entropy (8bit):5.27355053792439
                                        Encrypted:false
                                        SSDEEP:192:10OW0cuqb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHnk76wS:Iuqb/+vaW1e07kF5fyLEZDS254
                                        MD5:0DFBBBD17E074941DCEF6E995E6BBE7A
                                        SHA1:DC4F67554CDA422929570A1DA422FA2349D7F216
                                        SHA-256:CB111613D1BC715D28CE5A7C1D2CB9AF791E4FA451AB133CD2E372DCEBA7BF7A
                                        SHA-512:8F9A2414E8AECF514F93A5352C41520312D4ED602D131FE60348C382026328BCD7653C46C2D7B274B5789053F0928C3A214170AE4E87A0C6B560002F18E01F48
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=2px&bgColorHeader=dddddd&bgTextureHeader=highlight_soft&bgImgOpacityHeader=50&borderColorHeader=dddddd&fcHeader=444444&iconColorHeader=0073ea&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=dddddd&fcContent=444444&iconColorContent=ff0084&bgColorDefault=f6f6f6&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dddddd&fcDefault=0073ea&iconColorDefault=666666&bgColorHover=0073ea&bgTextureHover=highlight_soft&bgImgOpacityHover=25

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29381)
                                        Category:dropped
                                        Size (bytes):31161
                                        Entropy (8bit):5.215426726449217
                                        Encrypted:false
                                        SSDEEP:384:IuqlcR8lOXHc11evzjzkmQ+4q6GpEqQSc7nfZBhVM:zFXHcEzjz1Eq6GpEqwBhG
                                        MD5:AC03FA666A7B451F80ED0CC13FAD2A61
                                        SHA1:6776165B37FBE486AA5DF65FC4DA6C0DC5263A83
                                        SHA-256:FA7C7C248D092B5859A3EBCF34BB4ACC5B673E5C9B0D0D38C6FC9DA86F2D5105
                                        SHA-512:631ECBDC098EDB237BA88335B8CD0CAB1EA5777E52663EE8C86FE067AEBC40DBC1CC9B2FA1079B845A6C975CC461547A8ED602A5770299EC02BA1BC7AE30E1A2
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=2px&bgColorHeader=dddddd&bgTextureHeader=highlight_soft&bgImgOpacityHeader=50&borderColorHeader=dddddd&fcHeader=444444&iconColorHeader=0073ea&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=dddddd&fcContent=444444&iconColorContent=ff0084&bgColorDefault=f6f6f6&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dddddd&fcDefault=0073ea&iconColorDefault=666666&bgColorHover=0073ea&bgTextureHover=highlight_soft&bgImgOpacityHover=25

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1357)
                                        Category:dropped
                                        Size (bytes):17790
                                        Entropy (8bit):5.06910679770385
                                        Encrypted:false
                                        SSDEEP:192:XOuik76wF5fyQCEcktpBVqYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhWZDjb0:XOu3F5fyLEZDS254
                                        MD5:2DF72AFC330A1550D9F5873B5C1B9E94
                                        SHA1:8E1503CCDF9C9D0C2B3D2C377F68AC0EAEF506A7
                                        SHA-256:6483A696BA691E280265BDA3B149780615B74F6E92168ECA7491A9391EEBF254
                                        SHA-512:DE9929B3298EF51CD5149AF8702DD2714CC18CF23482A1BE8D20F1B4FB7CDF4D520BDBD3194C30984686CC32037C3C854CE895D7B9F528144295395828E3B426
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=2px&bgColorHeader=dddddd&bgTextureHeader=highlight_soft&bgImgOpacityHeader=50&borderColorHeader=dddddd&fcHeader=444444&iconColorHeader=0073ea&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=dddddd&fcContent=444444&iconColorContent=ff0084&bgColorDefault=f6f6f6&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dddddd&fcDefault=0073ea&iconColorDefault=666666&bgColorHover=0073ea&bgTextureHover=highlight_soft&bgImgOpacityHover=25&borderColorHover=0073ea&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=ffffff&bgTextureActive=glass&bgImgOpacityA

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_diagonals-small_40_db4865_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):390
                                        Entropy (8bit):6.412660102227287
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+g6m4MbPANBEsHalgzS+EELEMPS:X9+g6m4MboNB/HalgzjEELEMPS
                                        MD5:4E0C10D138AC4D6E1F5FBF2C3F12C6F0
                                        SHA1:8CDF55C9A9A30B671CE782E68FC3747AD3362158
                                        SHA-256:7B576CBF72A47E77132D59D5B955ABEB5471796D27A3E83E6613C8164740FAF0
                                        SHA-512:30D1ED9641CDD3E88FBF7700931DFEC6DC77BE928D98A13EF0635A6DE7B4427111A7075DB8B4850C41CDFA7A16327648590AA559239B01ADEC13EF1DC627EE40
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....@.DQXEB..E#.k...U...A.=..L..9.7g.R.4l9.g_.+.........>).?|R4...`.....c./....0.1..1.a.c...vH....K.0.1.a.;.h~..%b....0..R4..+._c..Y....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_diagonals-small_50_93c3cd_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):391
                                        Entropy (8bit):6.370731262783017
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP2gUyKfp5EJ4/al/Sdssq/7Swff+Dr+1Zx8uv7/axzgN+E8VLEMlVbEbp:6v/7egU9+HlKdstOPiFxKzS+EELEMPS
                                        MD5:1B1CC1CB76DF40329A52A4BD9CC75EA6
                                        SHA1:330262B70015FABBB8DA025214432A0AEF07A9F7
                                        SHA-256:8EFAFBBCD3D8B327FF15D57967185B635676B417A1BEA6CF9861FFA07D734B50
                                        SHA-512:C0CAE010535E73B04EDE6F7B7F386FD40CFDB1BBDF99A650B4433B468EA95E97A78C2464A5FEF477E70004443147F7B03381CB321D618AFE54F4699CCEAE6FCE
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....@..Q..X.`..dA.Y.e.5!X.....g..p.I^_J..u.M.8.._....NJ.....?8)9.pR4.a...5.K..5.a..Rr~...5.a.kX..._.D.kX...0!%..0/Q....5LH.....`A.1.^...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_diagonals-small_50_ff3853_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):388
                                        Entropy (8bit):6.354872721575915
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+GZyyxlpD+jEcd5F3QKzS+EELEMPS:X9+svp0vPbzjEELEMPS
                                        MD5:10AC5210150D17551470BC939DA04A60
                                        SHA1:BA2E3737ECAEA469D9F85EEC6F14C69690D87037
                                        SHA-256:A93394C7BEC90E6F898F8F1F9D33BB1725F3AD1907DFA6224CDCA7F254414BF5
                                        SHA-512:F60D6979A7C6455058B7D4DFA2E01FED81A2285E10624501382858810AD1E250849DED139B5E8189C22450A00CA4BEC1ACDFBFF3454F52BF503FE9C45701F2C7
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....0.D..j...GfR$..p..t<,;.?..y......me...u....'E....{..h..I..+;.....1.a.c...vH....K.0.1.a.;.hv..%b....0..R4;...1.a.c...)....Y@.J.a....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_diagonals-small_75_ccd232_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):391
                                        Entropy (8bit):6.349775460966113
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP2gUyKfp5EJ4/ah/0jGUq5vJ2r+1Zx8Q8lIzgN+E8VLEMlVbEbp:6v/7egU9+Hhcw2iFDzS+EELEMPS
                                        MD5:720A6733061E091A739F0E3FF957DE8C
                                        SHA1:8E0E34E79B5479713B0081350EFE98B1F0F1E545
                                        SHA-256:05E59552BCBFF8E1E263B554683A04BCC0CE0C9A0E1AF4A10CBA37554EC1A314
                                        SHA-512:6381A5F6B483B0445BFB2E9D40B424B0FAF596BA8A89793DECEF3BD741DECB5CE23299D1C19BF3A3B712145E2309F86944009DE1003F6AAEB79FE29A0DFBE11C
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh...1..@..Q.; A.....0D...N....--...[M.Jk..:.6.c,.y\.....NJ.....?8)9..0.Q....5LH..5.K..5.a..Rr~...5.a.kX..._.D.kX...0!%..0/Q....?..U........%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_dots-medium_80_ffff38_4x4.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 4 x 4, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):283
                                        Entropy (8bit):5.665634854822703
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP7TCUyKfp5EJ4/idkRRb2zgN+E8VLEMlVbEbp:6v/7SU9+5C6zS+EELEMPS
                                        MD5:7D8B6B72638427A0E1C392E20CB32D66
                                        SHA1:387DFE019CCFDB830337C0D7050BB8A5F0F41E1C
                                        SHA-256:6165C234EFBE5BF7BD1FE9A81565617C9D7645004BBC4BD8C12E18A58270E531
                                        SHA-512:D6F5A58FF14B21F1149D41A5339CAC1C80A3D0F81719B283F06340189D5E8AAC19EBCF346D1DFBB9642BF1CF7E1A9E62C8C667D9E0937EF854048ED6A4A4C5DD
                                        Malicious:false
                                        Preview:.PNG........IHDR.............v..j....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT..c...........`.X"H..T...(.R....,?...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_dots-small_35_35414f_2x2.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 2 x 2, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):281
                                        Entropy (8bit):5.646173013782732
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP2+UyKfp5EJ4/36uLZrIzgN+E8VLEMlVbEbp:6v/7ZU9+cRIzS+EELEMPS
                                        MD5:8E8F8AEE6EACB637989B7219DE450E22
                                        SHA1:F8C70020AC19E9C72028AF3AE1A89DC6733EE7CF
                                        SHA-256:1652C711D94344091329CD44FD113CFCF64EDE343139425614400CB81199C991
                                        SHA-512:4A89FEC42E9D191E22DB5681B6B8308DA280B20C09807F60068BE36BF06CAA956F45AD34CAD48CC67A3656EC3F453EB37D58B61A7D79CE6A19BEB99C6133232A
                                        Malicious:false
                                        Preview:.PNG........IHDR..............DF0....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT..c45ut..g``````.P......(.. .L.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_white-lines_85_f7f7ba_40x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):422
                                        Entropy (8bit):6.134023606491844
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPSaCUyKfp5EJ4/alZgmRsZL+wO2zgN+E8VLEMlVbEbp:6v/76aCU9+imM9zS+EELEMPS
                                        MD5:A487D190889A22604DD005EFCBB35C76
                                        SHA1:4795B34872158DFA003B6BB9401F2726BDBA0C78
                                        SHA-256:DD76479A304E49E86F3EEFCEBD619BC73F1CDC8C12D0327C6F44F3BD3E8E28B7
                                        SHA-512:9AED42B04D2B663F01C3AA9EE462A2ECF3E69A79DED157A9261D97D4084CB895E46606B22CEED3A93EEB17D5EE18DAFBFEA23641094670251B43FDCEDD83B69F
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...d.....+.9n....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATx...1..0..AJ*..##^.....<w.~...Z....u...<.y._g.gX:..u...t...,]g.:K.Y...u...t...,]g.:K.Y...u...t...,]g.:K.Y...u...t...,]g.:K.Y...u...t...,]g.:K.Y...u...t...,]g.:K..n..]..!...=...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_454545_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.925434318681863
                                        Encrypted:false
                                        SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                        MD5:5C3BA680CC34CD9B30855C180474A152
                                        SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                        SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                        SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_88a206_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7631740339012625
                                        Encrypted:false
                                        SSDEEP:96:MNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:WHm231Nvu+wIqltWOe3nIP
                                        MD5:6F8361C3E4351B84BF3449B2701CE861
                                        SHA1:EF8C4855A849C16CEA1650017A6404E70BAC3181
                                        SHA-256:907AADF33361459CCEA40A206C98931326960C582B5CC11C2CE810B479942145
                                        SHA-512:8D0124F13FB863733C33839B3D4F56237ED2714F15E18889305E05F8D8032760C092C5D2D6DEF9312A8B99AF4EEC157A64934F130AD59DC3B5E6FC377CC0E432
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................Y......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_c02669_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.772342562166625
                                        Encrypted:false
                                        SSDEEP:96:P6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:8Hm231Nvu+wIqltWOe3nIP
                                        MD5:FE57FF3C330F2C99D0ECA3B4A62193D4
                                        SHA1:5C8737BF0BD8604E8147B08748961E88D16E3A9B
                                        SHA-256:303BCAF3594BCFEFDB6AC4AE0515E861D5F49DF2C0C2FA8B347C405AC1A2E270
                                        SHA-512:AB06288B03703973591848CA0CBD17EBF2C03A222C4F7365EA329870DCA90731C5DF30C21E7D741EE8D62FC1C4B6DB4C5C3FF91E5F0E0E7BBB73BA5D75446914
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.?.7...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_e1e463_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.771406934410624
                                        Encrypted:false
                                        SSDEEP:96:dNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:NHm231Nvu+wIqltWOe3nIP
                                        MD5:ED955934AE5EA87AB2F0957D40FA4267
                                        SHA1:2DC74F149F07A61B25EACA2F56652278896CAE30
                                        SHA-256:3EA861761D71742E401F877935F3BB1A18E69F2687019CDC7CC8C2C64427D80F
                                        SHA-512:A25FEC163A11C11AE732C2BD1D0FFC5A5D01669FF29C74826B05AE211D64A1EABB5514B69A2F518748CBFC93C3AE5D1D3FDECB730955313A89C6573CC8BE25A9
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c@#.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_ffeb33_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.765983658404223
                                        Encrypted:false
                                        SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                        MD5:9D00A6D4BA4F79E2BCEE3E63231D34E5
                                        SHA1:E33289D398EE9D09397CC524818AEB7F591446CE
                                        SHA-256:05B3A820CA3017660904F14267F7A4D63BD6836AE1CD976655C5075C08BC5976
                                        SHA-512:A6671EC92532446B5930534539891A4B54D1A61CCDF8160C98F2480B1D2499FC33EE13133E100590D3B923C96CF74E2AB5D22B710A92727F2AFF0F630A426D34
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36678
                                        Entropy (8bit):5.286597440644566
                                        Encrypted:false
                                        SSDEEP:192:10OW0DJHdb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHif/YA:J9b/+vaW1e07xF5fyNEfDS25k
                                        MD5:36397A5A1B350CC70097C4E07929FA35
                                        SHA1:E847C13C022A0CC51A709EE629582764FEC47DA0
                                        SHA-256:64B283D576CFE63228E63E652B10A4A3A3738E132981FEF6491E155BFBFA5D96
                                        SHA-512:84DFFA8865349E7B0DBC3237CBF17FE2EE8522993ED7C12DDAC39F7896987DFBF5B23BB6197E5E29EBDB4C426772820059E2AEA8EB6C39D53CD642290B44652D
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Gill%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=4px&bgColorHeader=35414f&bgTextureHeader=dots_small&bgImgOpacityHeader=35&borderColorHeader=2c4359&fcHeader=e1e463&iconColorHeader=e1e463&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=2c4359&iconColorContent=c02669&bgColorDefault=93c3cd&bgTextureDefault=diagonals_small&bgImgOpacityDefault=50&borderColorDefault=93c3cd&fcDefault=333333&iconColorDefault=ffffff&bgColorHover=ccd232&bgTextureHover=diagonals_small&bgImgOpacityHover=75&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29631)
                                        Category:dropped
                                        Size (bytes):31446
                                        Entropy (8bit):5.231060034048568
                                        Encrypted:false
                                        SSDEEP:384:J9lcR8lOXHc11evFVz5m6+406GYznPSc7nfZBhV1:yXHcEFVzUa06GYznBBhn
                                        MD5:1B832A993E798FC7FFC284180638122C
                                        SHA1:058805999875DF95CEAE1950FDA6BBEE951383F5
                                        SHA-256:08C88929232369FC82BFA1AC22701C7D8A085926D420506AF825CAD7F180155D
                                        SHA-512:5D23EEF553B5340812841673EB59053CB83EAD062D9768F98A044B62B616E9A6085680DDBEE3EDB3CE4E91E73C2112C1CDCE70640BFBC0C89410DAB184C31874
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Gill%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=4px&bgColorHeader=35414f&bgTextureHeader=dots_small&bgImgOpacityHeader=35&borderColorHeader=2c4359&fcHeader=e1e463&iconColorHeader=e1e463&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=2c4359&iconColorContent=c02669&bgColorDefault=93c3cd&bgTextureDefault=diagonals_small&bgImgOpacityDefault=50&borderColorDefault=93c3cd&fcDefault=333333&iconColorDefault=ffffff&bgColorHover=ccd232&bgTextureHover=diagonals_small&bgImgOpacityHover=75&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1392)
                                        Category:dropped
                                        Size (bytes):18024
                                        Entropy (8bit):5.097226917357615
                                        Encrypted:false
                                        SSDEEP:192:XhJHef/YL+EF5fy3W/EtEc2tyAArYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhp7:XbtF5fyNEfDS25k
                                        MD5:F7093D52EFCAD4980108022C708E38E6
                                        SHA1:63639060CF664EF5D32652EBE81026EFA09F7C2B
                                        SHA-256:957FFCC659BD342D3D119D217B71D3870E2BB3EEF1F0427EA361CC9A882EFC8C
                                        SHA-512:DAE35BE29C8F5F87B416307ED7A506A9CD9A23DEE4BC3992FD078DEF8675208B220FCB9E3A5AA436242D265F589357A36C12E0B18F879BDFEB142B75C67F9C83
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Gill%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=4px&bgColorHeader=35414f&bgTextureHeader=dots_small&bgImgOpacityHeader=35&borderColorHeader=2c4359&fcHeader=e1e463&iconColorHeader=e1e463&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=2c4359&iconColorContent=c02669&bgColorDefault=93c3cd&bgTextureDefault=diagonals_small&bgImgOpacityDefault=50&borderColorDefault=93c3cd&fcDefault=333333&iconColorDefault=ffffff&bgColorHover=ccd232&bgTextureHover=diagonals_small&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=db4865&bgTextureActive=diagonals_small&bgIm

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_glass_100_f5f0e5_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):412
                                        Entropy (8bit):6.496577555859627
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+eeOG85ePv5yvzS+EELEMPS:krr9+8GweEvzjEELEMPS
                                        MD5:69BF34EF32FD7F228D36E9A129D7FF66
                                        SHA1:3C5010F8A57A1F64A75571891A4A9396BFC98991
                                        SHA-256:14C4D36F86216BED8AB46E05948440540C6C46471EE05820334CA09D07295390
                                        SHA-512:98DDFA6DBE190479041BB39E2C7480F99D35FF42CA9BD09FBDEA47A74963A9134CE44892A96D500D9F42C498122A0B5ABC2A2F91618F7E7CE67CB4F11D36C9D8
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...1..A....MAh......AHD....)......I..t.GP........S...........a...60F.(.me.k_`..I.9.TA...6Eq....n.Z......+..m?b...UW..4.;u3}B..j....D...,..h...i.a....k.@..it....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_glass_25_cb842e_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):393
                                        Entropy (8bit):6.5155240134751295
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+J14hJAjIF2lr2zS+EELEMPS:krr9+J14o062zjEELEMPS
                                        MD5:5D7674A2015FB83A6E8F71FCCDC77787
                                        SHA1:F540B9B656AA397EC44C528533C8D2DC86C38657
                                        SHA-256:43D59E2F8DF1DBCB758D5A15F0E41326939BDB34E5BCD343C91CBF90EBF8FA28
                                        SHA-512:0D013077587A14CF075CB4C1B46ACE965C64D9A86AB0AEC2F93D6D3E24C119E7037E6C68F144E701DCAFF5512E611E3CF38B3A40C32FEB4B73575E69AC9E1FB7
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...!..@......V.....&.A....h..55.N.%.&.j,..)....~.Y|....p..q....:<G....%{a..1.. .J.B.e.......aR.[%;.{.l-DU.b.R.........H;.......!'.s.T...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_glass_70_ede4d4_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):409
                                        Entropy (8bit):6.553771963328409
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh1r+UyKfp5EJ4/XzgB7HolAClIo5syYdKUDSKzgN+E8VLEMlVbEbp:6v/7J1r+U9+9NHolnB5ESKzS+EELEMPS
                                        MD5:1338B2F36305DF419F9D02073EE82260
                                        SHA1:38C3AF97436D91927ED81441940E81987493C876
                                        SHA-256:445572C0E2730CD024D4B4677EABDF8FADF90BD220E6FC9BBBB391DA3E2F4B1E
                                        SHA-512:058DEB7E62A00524EF3AB8EF327E0E45BB4192782E0FCEC3DCFCC4246C85C931635FC95A016FD201DD98710D06A909B2D9FD511D35657109278EFD993F996ECB
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...........FR..b.R^.zO......~....d.(.A.`Q..KwGw.b..b.O.....6>....0...:.{>HCD...w.!.......f...=>5Er.....dQsq.....1......[......M.D6J..A(.......0~..n.3'j.W....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_highlight-hard_100_f4f0ec_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):385
                                        Entropy (8bit):6.445561092623
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJ4/3MtXKUh9EuCOm4UwEZY2zgN+E8VLEMlVbEbp:6v/7WogU9+LbvEuCOmdvzS+EELEMPS
                                        MD5:EFCC4A901D32B64E9234EE8331069665
                                        SHA1:B6652C311B7935EDB6955DE30C6A8A9198C599F3
                                        SHA-256:AE37955D964E1F3CD40B6F48287CE5F26C08C3995877017D93A2E34CABDDC427
                                        SHA-512:368F9FC5DA1D715B55CF77E97D60E0B78F398BC21513E1359622D9D597712ECD011BA3F3018AA4A2DA0BEBB455A099356957251F370C169BEEEF488CDF53012E
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(...!..@....o..(<.O.'!...._.%X.G....Opm....!.hB....;..X....D.S.M.=.$.......6..g....r9c...i.L..n.....>...T].}.UcBh.....O...k>L. .a...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_highlight-hard_65_fee4bd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):372
                                        Entropy (8bit):6.343100446698306
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJ4/6UbEn19st28A04nqJ8qlRVgiFcSuf+vzgN+E8VLEMlVbG:6v/7WogU9+RLn3sXADn6lRVgoxQ+vzSr
                                        MD5:C2DDEA1F78686FF032149F477DE9DF46
                                        SHA1:71EA6516F3C1F906F19D9820C47678A73FFD70E1
                                        SHA-256:ADA10D93CD8D332A65CB059BBDDD09DA62A8D534CC7A5F59CCFD49B630B2AFBA
                                        SHA-512:DC35F8B48D06A4EC8764FD80FDF4759B625D06BD7D89964B2A3B133EEF95294C72B47D4B14EAE829F7B5441F79A03575BAC8C8A3046BCC81399037E80CEA61A6
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......xIDAT(.....A.D.QW.XP.p-@B.G..h...*h....s......MHP.xc.o... ....x..*.].Dv.H^.,FO......&.btSO"..{...L./c%...r......!.B.:.P|v]...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_highlight-hard_75_f5f5b5_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):381
                                        Entropy (8bit):6.3424039844238544
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJ4/0DvsNj3jwZcUqa/dTv1c9dR6Oi6zgN+E8VLEMlVbEbp:6v/7WogU9+aNTjszqYL1S99zS+EELEM6
                                        MD5:586F9F3503FCB7F946CD446094936AB9
                                        SHA1:03B3DAA94DAFC7FF7AF1EBAFF98E9FF5467EB34C
                                        SHA-256:DA1919C9B136E3AD109E49415A731B2A4129C78B4AC3ADE387E60BB279644625
                                        SHA-512:6DF64AF4A0C1CE4BAFEB30AD6DE699C44E62BC219559543FA07644E82647419F69D9E8DCE507FFC6A23D39C05ED201C996D7A1099E4CAACAB38C329A19C326DF
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(.....`.F..;.]..xY.7".::..8.X.-.Ckx...|.._Css.M.v..K~O...>a._....10..y..Z..&....Y..1.RKO.y.E|..*f...1..],EO....|..w...)^..;...#[...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_inset-soft_100_f4f0ec_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):461
                                        Entropy (8bit):6.769093155244375
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+w8Elrm+vRBB5E7jL2zS+EELEMPS:no19+glrNfE/qzjEELEMPS
                                        MD5:65A7EE8510678A4E6F1B6E4556FA91DD
                                        SHA1:020587178A4C3F8A02D23DE838F0BD44C56D7C18
                                        SHA-256:F85CD2797BD6CB66C2BAC16DDD8209BFD06688DF884DA7A389FBEE3669613DE5
                                        SHA-512:AFBB0527F0539543548D9ED84CA735328FBCF8532C637FE4ACA357963B82CA643FCD6498FC302BB21493A407E10FD37558F06CE04149591A21EF67D28FFE7A99
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(...K.Q....=t"...h.....%E..Y....l.....`..Xdm.".I4..,......{.w.f..0........4U....`.g......G...a.}.L..e}9}G"...!.E;{Et1..p.f5.+.......-.S../...Pt.5....\......Zt#.P....C5(.y...%.........s...(..+.i..._...{[..';J...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_c47a23_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.765571973013318
                                        Encrypted:false
                                        SSDEEP:96:6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:0Hm231Nvu+wIqltWOe3nIP
                                        MD5:258CC1658196388E44F44CE2CA342839
                                        SHA1:CFF5E5A39B568471E5265A1B90FA4C26582CE371
                                        SHA-256:8A50E81928F2FF1CFB83CEE554E368412965A658A02074C4D75FE6EFE2938095
                                        SHA-512:D3059387D0ACF67B549BE4AD5D1E78A7FD7F88164FAD7A51A4B1A1FB0E4C2134699DEB5C0B4838BEFB433E6B4FD4EC75255FE7625D3527FFA1F5D5DB35A24988
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.a%2...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_cb672b_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.774920146248026
                                        Encrypted:false
                                        SSDEEP:96:mVNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:mlHm231Nvu+wIqltWOe3nIP
                                        MD5:6854089D6E540ED92F49B4697790DEEF
                                        SHA1:03D9D6114763DD07E81209520BFC815466C83E48
                                        SHA-256:C01309AF5216C7C917D49C3570720640D663B8ADED6A8A7A0DE0A25EFB0269F3
                                        SHA-512:30CF018338DA4BADC610B4184D2A086CF186C6318732839485CF6629C3D76FA886A23CD431D33F187A194B85E0797568746B7027E2CA83EA114B94777811EE82
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.(T~...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_f08000_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.737504834420342
                                        Encrypted:false
                                        SSDEEP:96:2VNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:sHm231Nvu+wIqltWOe3nIP
                                        MD5:C042A8B4780C14B1C866FAE17E9D68D7
                                        SHA1:084FC7A1BB68B972680A6F4D28F6C257D94CC270
                                        SHA-256:55FC63139CE52570A1FBEA3CBD2013D44D40978B76817EDC7BE50985F09FB31E
                                        SHA-512:249EF041AC3D9A21AE44F47C64D467E3147B44151D32C59F833C83A34308C474DEADC7F6E1D9D062A13BB29F4B22B08863CD776051F12E3609227FABA5322A4A
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................r3.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_f35f07_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.772920110125113
                                        Encrypted:false
                                        SSDEEP:96:eNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:wHm231Nvu+wIqltWOe3nIP
                                        MD5:5BE468BBE60C121128DD56D098304C70
                                        SHA1:1D7F99B89E9B9BBA19DE431ADD2A4E09FF12E61A
                                        SHA-256:FEB9D17256C1DA0668B0BA4294129FC70CE41F93280D047D3DAF36FE68F18EF0
                                        SHA-512:58FC62D4E6DDB5CDDBA6C83A2F767E24E11F868C614EDB2DC6966A4FD5783B356EF6E3508DFA3C04DC0A0BAFC63B459B9793366046C83DC22A73EC5D09721B71
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._....P...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_ff7519_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.76872546534799
                                        Encrypted:false
                                        SSDEEP:96:MsNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:XHm231Nvu+wIqltWOe3nIP
                                        MD5:90D4B95F7F5018E66653FF33D32F35A6
                                        SHA1:0AEA94585C167FB945886AE060AF265690E11AA3
                                        SHA-256:5E8091D9C902F959F52E76DB516B55E2AAAC0050073A1815AA3A2DF53EA7E9CD
                                        SHA-512:68A8B2C2430E1AEFEE986C32B2C877A843E2AE9E94DA6A591860917C4316E35DEEE733EC69EB0368910EA5B4FD298234634EAF84EC9947A71AB3495E6FD3363E
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u....z...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36663
                                        Entropy (8bit):5.280742395188275
                                        Encrypted:false
                                        SSDEEP:192:10OW0z6inb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHDPGgQ:P6inb/+vaW1e07fxF5fyfEnDS25elak
                                        MD5:674D8DEC33C5F767656EA4CA9D3B1E49
                                        SHA1:25467C7287E18CC3F9B25E7C6A4062F0BEF8418C
                                        SHA-256:9C01DCB690FD699B47F9A5789B94C6C262BDE16F9CE2897344F7D0BB13731F2F
                                        SHA-512:E72BEE17EFA750C379FD467B6F4428E06DA78DEC467D3CDC3B484F86D3157826F5F705FDA5A45B119905C04D9FA533F27E120C3C0F7A065515CDEC16D32E1EB4
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cb842e&bgTextureHeader=glass&bgImgOpacityHeader=25&borderColorHeader=d49768&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=f4f0ec&bgTextureContent=inset_soft&bgImgOpacityContent=100&borderColorContent=e0cfc2&fcContent=1e1b1d&iconColorContent=c47a23&bgColorDefault=ede4d4&bgTextureDefault=glass&bgImgOpacityDefault=70&borderColorDefault=cdc3b7&fcDefault=3f3731&iconColorDefault=f08000&bgColorHover=f5f0e5&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29655)
                                        Category:dropped
                                        Size (bytes):31449
                                        Entropy (8bit):5.225591069957868
                                        Encrypted:false
                                        SSDEEP:384:P6inlcR8lOXHc11evZezYmo+4a6Gb+UoSc7nfZBhVpWGc:CiOXHcEZezJsa6Gb+U4BhI
                                        MD5:A5716D950139D94F9E7242DB8B4E761F
                                        SHA1:45A232921F3E540FC44E6CCBC60FEB3825227013
                                        SHA-256:CB99219FC9221A319DFD8D39EC0842D5669AD23F20EBA2781C9110DE9CB5BF8A
                                        SHA-512:3BE5DB0802811EA6AA0D5503DF0C2826D555EA4400E038E41F6267B15A213BB053B47D8AA38AEB67BCEAF0CA8478683B1EFE0C55910EB3B005DE23F3B0BCB1B0
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cb842e&bgTextureHeader=glass&bgImgOpacityHeader=25&borderColorHeader=d49768&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=f4f0ec&bgTextureContent=inset_soft&bgImgOpacityContent=100&borderColorContent=e0cfc2&fcContent=1e1b1d&iconColorContent=c47a23&bgColorDefault=ede4d4&bgTextureDefault=glass&bgImgOpacityDefault=70&borderColorDefault=cdc3b7&fcDefault=3f3731&iconColorDefault=f08000&bgColorHover=f5f0e5&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1371)
                                        Category:dropped
                                        Size (bytes):18009
                                        Entropy (8bit):5.086710250031702
                                        Encrypted:false
                                        SSDEEP:192:XV6ilPGgBT7pF5fydQKHxrEck1n7HcugmB0iBfT9RhS2wV53skuMaaSQhQz0iIhJ:XV6iVxF5fyfEnDS25elak
                                        MD5:23894B7DE810C64646B893B2ACDCD2AE
                                        SHA1:5F5D705E8DAFB123FFCC66170E7E950D74D22439
                                        SHA-256:0EA261BF9D84D24960C2FA03342951BB2277D1AF7979D09F76F6DECA83D58A65
                                        SHA-512:955BE102E9616D6C9DE3F7DDDBE19AE3C229DFF63F86711C87B5D8C1A3D1329EDE106522B8B17CEB745821EEFB3539205B4B0C0D3ADC49EC1090EA25C36F1F56
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cb842e&bgTextureHeader=glass&bgImgOpacityHeader=25&borderColorHeader=d49768&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=f4f0ec&bgTextureContent=inset_soft&bgImgOpacityContent=100&borderColorContent=e0cfc2&fcContent=1e1b1d&iconColorContent=c47a23&bgColorDefault=ede4d4&bgTextureDefault=glass&bgImgOpacityDefault=70&borderColorDefault=cdc3b7&fcDefault=3f3731&iconColorDefault=f08000&bgColorHover=f5f0e5&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=f5ad66&fcHover=a46313&iconColorHover=f08000&bgColorActive=f4f0ec&bgTextureActive=highlight_hard&bgImgOpacityActive=100

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_diagonals-small_0_aaaaaa_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 2-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):265
                                        Entropy (8bit):5.540970259068032
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPCCXUyKOCll429uzgN+E3VKF2EMiVAVTp:6v/7KCUj9uzS+E3V+2EMiVw9
                                        MD5:CF7E81416128126610509E22CBD9999E
                                        SHA1:1B2CCB53763564EEB7B554591E144AB1A423A4A6
                                        SHA-256:918E530A373F786E040E2AB16A45430DC6203B412B93300C7C3FA657DFC1001C
                                        SHA-512:16B515F1A48FBF362034AE29F78774E55AC2119267AB6E8D270A98110F7AA4A4134D6616D07C7D4D8AF62115B1A1D91F43D32B21D682EEDC839B8094D78032E5
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(......%......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..3.r.....tIME....."........IDAT..cX........T.....J....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_diagonals-thick_15_444444_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):383
                                        Entropy (8bit):6.464989287779997
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP0CUyKOkuhGpY/EfbSO6iZvxxMrzgN+E3VKF2EMiVAVTp:6v/7MCU4GpiEjSiZpxMrzS+E3V+2EMiw
                                        MD5:A0C61FF561D4CB1E68B4D9877848AB0E
                                        SHA1:F2927DD772F61EE4C58B47030F4BD52F73C1B8F8
                                        SHA-256:573A4C7CAC703E66D4B3C08B4FB9332C4477E9DFB6350D048084C429295AAE69
                                        SHA-512:3B3E9747871C3230C755C1C0DB42997AD37FA5A79DA81B6F10BDD9BC6D8E9C24B78D14246EBA331613234F66817ECD3B6EEA78F59016D76E73BB4218037501B3
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDATH...1..0...g........DO.R.."B..!o......8.R....I...n....q.......u..p........Hp..p7Hq..8.XN2..|l.....dC.0..@...E......os.)?......)..:...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_diagonals-thick_95_ffdc2e_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):469
                                        Entropy (8bit):6.686740128366266
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+MMU/UvwitI4Y4CWYYKkslTYYKxMzS+E3V+2EMiVw9:X9+bQU4UmX/k8oxMzjE82EMr
                                        MD5:301317202CED65E4879EFA5D9A95F62F
                                        SHA1:C061EFAFA478E9F724635FB74C2D65851FD0FEB2
                                        SHA-256:21DDACBA4BA0C9F48819307D3F2765E11DA34CFF8C002E85E2865119BD08E765
                                        SHA-512:7BF8D5762185D04B6ADA6EA5E5FE16889D0BA19DC67CE55129A49CA7332E5F1FC90C21B552E1080E41F144EB7DA368EC910E740FD05B7284B8D4CBD5C561A2E2
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATh.....0..a.....'.d.L.:.&{x.`..Jq.B(.NE....9._......:..y{|&u......G..Z.3.Y0....T...ql...d.X.J..l.*W#.@m.s.U0.Z.3.Y0.......B.`/T........J......j#.C..i...I.....J...M.Nm.s.U0.Z.3.Y0.......B.`/.i..`.T..@.|.&.G_..>^...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_glass_55_fbf5d0_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):394
                                        Entropy (8bit):6.499591053088131
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+rxpJ7Hp7D53zS+E3V+2EMiVw9:krr9+ND7J7D53zjE82EMr
                                        MD5:EC110959652282C6FE3E62C6FD4CC154
                                        SHA1:56FC65EA1486D038F30962D02608140099740DDE
                                        SHA-256:3C3E23F38BDC19B76BC8DBFDE2953CFE8F099699F6EF2DD1A1B05D4BB3DD92C3
                                        SHA-512:8F7E5B7DB77D5FA4D63DF58B5234ECB06F88FB762ED56DC15181AB6461692EE518E1971F1650A0BD7CE0C1FA68D34E90510E1CFB8ADC28EDC67946DE87FE5E2A
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH...-.........&gc~.!...&E........y....c....A..N....W.\....q.oC.5MQ....c+BR....b....s...-.\$.t.....l..D.d.."...3.6...V.....1 ....8...... .W..h...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_highlight-hard_30_285c00_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):382
                                        Entropy (8bit):6.46202797803152
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5E/UzyTtCaqTcAqfB2KzgN+E3VKF2EMiVAVTp:6v/7WogU9+/nzqTcAqfwKzS+E3V+2EMr
                                        MD5:DE474B9583FAEAFB12C9E27B8873B8D0
                                        SHA1:D64D63A0AD8155C89D74300EE71EBCE6A25751C8
                                        SHA-256:AA670F547114F5CD5465E89B7C4A57DDDC8362FCC301E013D6A0DB4162BCCE3F
                                        SHA-512:09E01F82E65920722E640F8D1A6D0A945A4A8C3874B9DF8FCE33DDCD6981A6FCA99BB7F16A785B51F1F1D0E8B543D405BAD53969B7307A1CDF58E56563DBAAF8
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....p....y.... ..[Y....h.hq.4..E.....`..\.`.+,}....mp..s...M|!.v..8.%.T.....|.....z.&.<..X.....'&......H..B..c...x.'....E.7.#...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_highlight-soft_33_3a8104_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):403
                                        Entropy (8bit):6.531002278304678
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+nuAcOfqhilRQWGRxzS+E3V+2EMiVw9:no19+nuAcOfc9RxzjE82EMr
                                        MD5:A5D6759D66ECDE0B728C18BFEAF51EC2
                                        SHA1:8FDA4B6D3E9274856AD0AD0F9E5EE11EA5796E66
                                        SHA-256:99E137811F7EAA484BBE02BAF6FF66FB27C19F4097287287D3F7494B761991D3
                                        SHA-512:4EF13AFC3C07D782B9369E2E6E538D5800BB1A5D6BA009C04C6D17A9B1CF68C03C454D0819412BD2CE70C14761E5F2765DCA2BE5FA0C5F298925AB2F3CC50877
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..1..Q.E_n.Lc%T_c%.".5L.Q.=Hf(|.e(...~%y.*d..HT'.6'.6_l7..33..........A'.5.^.R].`.Gh....j<.Y.#.Y{..j......e;.Ak.CA..<....G..^...|h.=ll+.}.......kE.......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_highlight-soft_50_4eb305_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):409
                                        Entropy (8bit):6.613438939057223
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+gnuOgMs+hvT2zS+E3V+2EMiVw9:no19+gnudMs+xqzjE82EMr
                                        MD5:C6494494A0005BB61DF5E2917692B256
                                        SHA1:6486952CDF9455DF0AA090AC02A7AB9B9CC46E6A
                                        SHA-256:29F2F668B93749532BF3C747A16CC839860859407388613454F30F7C15B0CF7E
                                        SHA-512:EC2EE8A71DBDC96A281D18A2E4C4D2BA6E8A0B6A0D016A06C773B2E2DFCC680B4CCA5FA7D129EFC72CF103ECB939234771AA1B0263B5576F5A965E1482D24E09
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..1..@.D?SY(.m...&^ ......7..Fk=...-..r...E..`...a....zh[......r......p...Hm...B...Q{...<.gT..,$.+9&..2J...CK..A..'.-60..=Y...3&.[....GY....q..~./."i..C3...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_highlight-soft_60_4ca20b_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):417
                                        Entropy (8bit):6.622137642581435
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+JlHsWxUdlQ3zS+E3V+2EMiVw9:no19+Ji2IlizjE82EMr
                                        MD5:7D6D3976BEEA0358ED75B21FDA5D0422
                                        SHA1:7E04E9D3626E201749C6532A7BB00858D6B06017
                                        SHA-256:4B2CB320917A627DF5FF7746170F0C68F975C81A53644A64C1E1BC0386B21E14
                                        SHA-512:A30B675E713155A282B8557EB08999029CBC45C9EBD3520181FC9F8B5650E23C04D1C17B91B7E73EC02999B1D827284C2BF8398503B2E692B4185DC9FCAB1E07
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..-..@.._F Z.A..@!.KB....].n.........@r.*....~.%..$./..d. wW/ADD.78..v.N...E)..E- ..y.....Y.=$.,.K.....u...].....K...Iz.-C(.5.C.....E).Z......R...mm..~.o..i.u..S...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_inset-soft_10_285c00_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):424
                                        Entropy (8bit):6.705633807193599
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+uxuIiknY8pw1eYORFtZ2zS+E3V+2EMiVw9:no19+uxu9IRdnXtIzjE82EMr
                                        MD5:9FDE0C11BDC11666126B7AD3E6999B9F
                                        SHA1:6250B784AB095051BC0C846ECC5B0147E9712DAB
                                        SHA-256:08F914E7F28C78428BA850B5B404E5475849F8FC3F6811CD8C4B9EF5751B9AFA
                                        SHA-512:76C31F8C6C21B2A27CE79EBF5D498120E6555278F7EA93AF6AD774B4CB44D788691BFC42E4F18A5AF9558EFFADAB1C3AE254295914226FDAF95BCB8901D1E48F
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(...!...........Z,......u...T.A.m.P.#...u....`.z...V-../}.h6.S0.?...e`..Y..g....;SL...u>)..#..)U..q$Pf..'....8F.....fJ.*7..J.*......+PV.....L.F..uz.[..:5..~...o'...zn...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-icons_4eb305_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.778798081854367
                                        Encrypted:false
                                        SSDEEP:96:EjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjT:LHm231Nvu+wIqltWOe3nIP
                                        MD5:7090419BC38A3AB8127077FEBED202D2
                                        SHA1:0D939387645972A3FA4787F9C4345A2E6BABA60E
                                        SHA-256:0CF6652148C57B54E8D8A925ADD5F37FB72DBB9E6FB3B43442CBCB1F25ED6044
                                        SHA-512:83C8EC99DDC8C528067F0CF3384C54914D502594CF71315D5F027A756370652A42E6F326DF0B0773689884CA3E744A9AA97B36DD8F6C8B6E7C64B2A5EF3252CE
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEN..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..| .....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-icons_72b42d_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.769506029578022
                                        Encrypted:false
                                        SSDEEP:96:+NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:QHm231Nvu+wIqltWOe3nIP
                                        MD5:3D61A0B492B7EC8E2BAE60A94F503449
                                        SHA1:63D2E84ACC2D0BB2BFAED6D954940F87A21B1E2D
                                        SHA-256:2C114911DC4BEFA3421BADCA73BEE144AF8F0EF3B31B350013828D57D2D32F4A
                                        SHA-512:28647907CC079F97019BEDF598E7543C01585D0E58EB8CEE7D756A2A493E922AC973913A992ADE3922DC92888517DD0B97127E7283276A0348384B43E3CB8EE0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEr.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-...b...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-icons_cd0a0a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739814671431308
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                        SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                        SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                        SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36838
                                        Entropy (8bit):5.2845268342781635
                                        Encrypted:false
                                        SSDEEP:192:10OW0Rmb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHwPwJiqy:Nmb/+vaW1e075F5fyEli6EDDS25f/
                                        MD5:D20F5D81D352E13A899D5873A103885F
                                        SHA1:F5F7655204CFA0371C00D15CE6AAAE705F35F00E
                                        SHA-256:F9957EC60C4F331637AD78C1B05E4103A10D7E3D7DD8B7DBCCA0198B7D3FA1AC
                                        SHA-512:9DC47C1C7E54B7AD52244429D65A3EDCB0AA0C11BB7AC27899776FBD5B9593B4E322B32F4083FB21BB8CA7392AC290A3BD2B7B0C4411F7AEFEF9A0184CA6AF0B
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=10px&bgColorHeader=3a8104&bgTextureHeader=highlight_soft&bgImgOpacityHeader=33&borderColorHeader=3f7506&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=285c00&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=72b42d&fcContent=ffffff&iconColorContent=72b42d&bgColorDefault=4ca20b&bgTextureDefault=highlight_soft&bgImgOpacityDefault=60&borderColorDefault=45930b&fcDefault=ffffff&iconColorDefault=ffffff&bgColorHover=4eb305&bgTextureHover=highl

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29741)
                                        Category:dropped
                                        Size (bytes):31593
                                        Entropy (8bit):5.22868903333992
                                        Encrypted:false
                                        SSDEEP:384:NmlcR8lOXHc11evNozkmn+4H6GpzdlSc7nfZBhVp0:rXHcENoz1zH6GpzdDBhM
                                        MD5:6FD17EC5CC2A8EAAD538F84F9EEBF7B7
                                        SHA1:1997FD0342613241A1CCD1FD7343128392FC5FFB
                                        SHA-256:8512F873BC5FB880C3937C47DB16B839EB74408A77DB37C3D4E0A57E5FCFF664
                                        SHA-512:EAFD40FFC636A6B82A33F8BCA43C50B75251ADF494C8831201B488DA3D79658A5222DFAB5117BE6096D912A00B94A7C86004F68D88AD8B186D679253845E6DFE
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=10px&bgColorHeader=3a8104&bgTextureHeader=highlight_soft&bgImgOpacityHeader=33&borderColorHeader=3f7506&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=285c00&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=72b42d&fcContent=ffffff&iconColorContent=72b42d&bgColorDefault=4ca20b&bgTextureDefault=highlight_soft&bgImgOpacityDefault=60&borderColorDefault=45930b&fcDefault=ffffff&iconColorDefault=ffffff&bgColorHover=4eb305&bgTextureHover=highl

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1429)
                                        Category:dropped
                                        Size (bytes):18184
                                        Entropy (8bit):5.095147589965305
                                        Encrypted:false
                                        SSDEEP:192:XXfPwJiqn/F5fyHoEc7li6Ecf1pAyNYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhM:XXyF5fyEli6EDDS25f/
                                        MD5:09E7BB15E9BE70C1B54840B55A4C6000
                                        SHA1:84D8BFAC5B5A6CAB84014ECBA9AAC663DF256446
                                        SHA-256:5850627DD750D41AA653DAFFB190B61085BF3DEBC944256BD4CD49B6EC729279
                                        SHA-512:0A268A8A5163814B9C9E5BAE5D9CBEEB79B467A467F6E324BAF51F654295CFA8F6F2DE7CBD1CCE77A792A16F09457781A85719C574F79142A32396B5DC80EC68
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=10px&bgColorHeader=3a8104&bgTextureHeader=highlight_soft&bgImgOpacityHeader=33&borderColorHeader=3f7506&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=285c00&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=72b42d&fcContent=ffffff&iconColorContent=72b42d&bgColorDefault=4ca20b&bgTextureDefault=highlight_soft&bgImgOpacityDefault=60&borderColorDefault=45930b&fcDefault=ffffff&iconColorDefault=ffffff&bgColorHover=4eb305&bgTextureHover=highlight_soft&bgImgOpacityHover=50&borderColorHover=8bd83b&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=285c00&bgTex

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_glass_15_5f391b_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):393
                                        Entropy (8bit):6.508024514807776
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+znd9Laf+pdT56W7Br2zS+EELEMPS:krr9+zbuf+pdN6gUzjEELEMPS
                                        MD5:34F6ABF331A51AF91C7323BA6391CEEB
                                        SHA1:D13053BA8DAEB3E18F71F54B7DC0AFCC9678D80D
                                        SHA-256:C40803C74B76AF9E74BC1DDAA9BEB1AB7104865EF7BD1052270385A01D3A1734
                                        SHA-512:F39F1CF6D785D5659800EDAF9099E3796A4D8860C9477EE6A05F091F1CD61E1F19F2D0EE70BD0CDB175616A3BD46EBB768AAA160D3D74475443EA85548D136FA
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...!..a...7..,&..v.Z5h.d0.....-F.`.+x...F...T......K..a`.f..$).. .:..}...6..[....q.....&AAM........#.k..b.3..>c...#..?N.A.........][J...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_gloss-wave_20_1c160d_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5851
                                        Entropy (8bit):7.6946038920456905
                                        Encrypted:false
                                        SSDEEP:96:fHkz7tzQ5Wx+dqQw+OTN80eCadVnm23KCanUUTJSqgk5iEatVIQoz+4FQ:P4tz9odJwh53ZyN37DNfk5iEA6z+4FQ
                                        MD5:861A9CB5CE63EAED1C371AAFCE1C7409
                                        SHA1:68392BA0330C55346192FF876F308314E3CC5A3E
                                        SHA-256:3D1985675857F2BBABE7D681C5CDAE2A7074435D96E6295A0D5863F12E752F91
                                        SHA-512:69DA4D565FED81E3B9EA9F5F383481DFF036074DAC37D602C2998E4CE5AF5683EF62FC38FB89DE4C578A25F27F4D0F293700B8A37213951B19F5B19023C89FBE
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATx..O.e.U........Effb..{fP..6V`C0.B.`I.N"GN..@..9.8N...b6cX .;.e..A...Yr..Hx....D.A$&.`....e.:..3.SU..w.....:u..[..{.............1.U;........;......`......0.......L.6.........;......`......0.......L.6.........;......`......0.......L.6.........;......`......0.......L.6........Z.....v.qD?.kc.^c.>....:m..P._.F..e.yu.-.d....^.....Z.3.W......M...fS=e..k9w.[.z_.7.!.2J.V^=k..(y.!..^..7..kb..5z.U..ZSf_.......R..x..#...f.7N.ja......0..[e..n.s..:...5{....M9..]....k[...W.....qrQo..Y...;.u..k...>.l..l..._.y...V..5*W....v..W?R3C..n].3Uv.......B.'^......n...m ........<.uc........Nx........`......0..a/...6..3{.G.,[.{.[....vlr..G....i....].YWR....2..C..T..R'..^j...p3h.,+..9b...-S5..G..J7.*r.5P....*.]Y{.N.z#*...Z._....ul...8Y.R....r.UY^..y[...j2[.cNI%.I..k.........f8.<...p9wd.s.[.}.~...}D.f..B.E.......6....[...s

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_gloss-wave_25_453326_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5910
                                        Entropy (8bit):7.684608225622468
                                        Encrypted:false
                                        SSDEEP:96:fH75LcyckRWaCXCdsD4nMoAAzge7VBdPF/gN2avx49q371JizscvHFpKbK:P1cyckRW5XCO4Mozo2UQqpJuzPFeK
                                        MD5:723B73CFFAF084B588D04A934E55F1D4
                                        SHA1:27021E05AE990916B9E8750AFE9BA3F478B9DDCD
                                        SHA-256:2AC203B05A8B8942CEC8F277E538F77244F432106C4B6B47F1777F4EE9D82D9D
                                        SHA-512:7A325550CF751531A2BFBBB6C62BBC16DF18F482A005D6650E4DC97371D70EE582467B7664BA2F44C74B4D3F25E5F8D1764DF048108B3D6F9494ABC99A06736C
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATx..O.]GV......@Jd!....q.V.=..!pB...6Q.c.....x.H..3.HHx.AL..;h......O$X...g....;..2...p..k....*.NU...o.<.[u..9U...w.......x..........Y.......pw........l......V.6......+..w........;.............`.`.........q.....X.........l......V.6......+..w........;.............`.`.........q.....X..q..=.s.#..X...%...c.bQ...<T..7z.bV...J.o.o..J/}^..Z.3k.W......M...fS9y..j9v.Z.z_.5.!.2J.VV=K..(y..!..V..7..kb..%z.U..Z.g_.(m..+WU..d....G......>.Jf......0.....t.n{..S..'1k.Q....7.H....>N.....Z.QZ.s4N....7k..Z....k.a..).S.f^..F/..%...uu.[.b5\...N...GJfh...z..V%...Q.jn....r.p...O.. ........,..^..;.................l......V....g...<p&.H.E.n.n..X...4.Q.#..<.bZ..L...+..HG.G.].!.m_..R'..VJ...p3h.,+..9....j.=..U..nJU.)k.R-..........k.(...k.~..zZ.!...d.J.......Wyy.FgmY..+.l^.1%.\.z....o~.........(.....C....m.......l..".yl...q..Ht.....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_gloss-wave_30_44372c_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5972
                                        Entropy (8bit):7.698212690009269
                                        Encrypted:false
                                        SSDEEP:96:fHsT+egenQUpb/nSSzb9W62p3VrrZrKmZTmiXJ5Rhqxwdju16tAQZgKzrayOFGg:PU+eBnQUhSkaprrKETJDRkkuBFqIGg
                                        MD5:7D2C0D67EB9BCF602B3F7512CBEFC48F
                                        SHA1:25E1FD526BFA0B8705AFC714509BF134F700B122
                                        SHA-256:AC21BFA995A4F3C39DDEE38115D21C3BB66CE057ED3FDD70268445DEA9C9790F
                                        SHA-512:44DAB62CB87F6191F839726A6DCF64F4E4F011BBE8C729965A1823C60815A7BA2BA7502CD2D482F769D40E5610E755E5B2C9E5DB216FEB858AC36CC35ADDEA37
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......XIDATx..O.'.U.{~.N....N..B...D..xgw.F.....^.%;.....K.#...n..A.XP.!..H$'..'rd...Q"$.8!$...\...-...gk...UU...?..=[]...{U.S..5...O..Y........].......pkxp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.n..>.{a..-z{..={.e.=e!.u.'.b?O.......`[(.7.%.+..ua..g....YE1%F=.J..r.V..r......o,S.}e.r..z...}.Q...C...xko.%..r.J..p.&...m..<V...K....#..<..._..72C........9*3..a..@]OR..Y....7.%...y_L.m..^e..v....r.......Y....*.S.f^..f/Y.%....uu..R5\.m.n~......t......U...Fd....<.Z...?...?]A&.......Y8.....v......,x..........;......0...^.m..3ag|ah...=..=.vR}b;...Y....<.RZ...g.u.Tr.....2..C..X..R'..^J...t+h.,+..5b....S5.G.[K7.*R.=P......]^...z#...^......}l...b..%.klA..J.Wyy.F..Y.,W...SJ*.8a.o}...ca3l.....~.M..$>.:.?f..lA......G..<5...=.M*

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_highlight-soft_20_201913_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):433
                                        Entropy (8bit):6.628713451990196
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+cDz1FZE2zqyr2avzS+EELEMPS:no19+cP5znvzjEELEMPS
                                        MD5:990000B89E984CF1855C16FB555A20E7
                                        SHA1:589223D8D62039EFF98959DCB400DBFA3F8C6E35
                                        SHA-256:0FF5041D63B8CBA449F5BC98C2821C5909220006D1C5B69F7E0F3AF6200AC309
                                        SHA-512:BC267087DA14BDC31C057BE5F354291415334849290DD2917C1AD9230570011320D958D6A87611B397F377FFB2E3CACF8D67367BC422FE11D77699B1C682EE0D
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(.....`.... .CE......4....dc.s......a..vm'..;`32....[ 1=.;..........7... th...4i..\y.Yt.J.3.J.3.B'.m..+...on.y..F..FkVO.".Lm\.D..TO..#*.;.^.~.n..$..R.mZ4^.,.q......o...<.<.Y.g".....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_highlight-soft_20_619226_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):401
                                        Entropy (8bit):6.461550350745626
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJ4/fIiRW7JBNsr4BMkGWkq/lkCzOzgN+E8VLEMlVbEbp:6v/7WogU9+k0PNsZuCCzOzS+EELEMPS
                                        MD5:AB79BC5BE3BC772DC46252B64FA824D1
                                        SHA1:567C105D0754702CA33ABD453B8EFC21A45B9D53
                                        SHA-256:9F503974690E4F4D59D9813C37C3B299225712742898004D29DF20FB73AE561F
                                        SHA-512:65DCAB4C036D93DC47F62181938F143ECC3489FC62A82F422E67B3AD63AB43FF2B585CB20DB1A143A947B0EF7B14793697EA45D1FE717C6B64C85879B9FE7CBD
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(....P....IE..E-...H..U.+.. ...h6h..,..x.....$./....4.....%I...t..TSXCj..QRq3..&gBk....d........h2=-...):..en=.d.........c....%;..F.-.......W...O...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_inset-soft_10_201913_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):438
                                        Entropy (8bit):6.6438218171907995
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+dynbgqGK3/RdPBp/7ayzS+EELEMPS:no19+AnJG0JBz7zjEELEMPS
                                        MD5:479B880D56FFDE90B540CD1A04A756E8
                                        SHA1:F1532AC398311E8084B8EBD88DC39D8741E493B9
                                        SHA-256:EDBECA747559B65BE63840BBBD28D3D08052FBF30138F5D9E68DF5AE53651C5E
                                        SHA-512:D3012A1896963953DAB12AFE05A8F48B8498B27A7FFC3D6F63E06AB03E64FD072EB2F83022FCFD5F722AFAD868C15048AB86F638D1679BDF2C022E02DAD8FA11
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(.....`...s~...V...3....4..Dbv.VWa"R.^...J>.. &..,.........or...1.lV......t.}.0..[A..wc%..p.%#./.{.!.1d$T..Q.n....p.*&...Z..p'T...k.iK..s........n.Y.N.#......ej#g.o\..-A..._..]../}.W.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_9bcc60_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.767895128988182
                                        Encrypted:false
                                        SSDEEP:96:2NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:IHm231Nvu+wIqltWOe3nIP
                                        MD5:0285460263EDD66D2D4101BDEC175D58
                                        SHA1:1801FB66888A8D3434C1DC3E68C5C0A2B2474E74
                                        SHA-256:B4D97785B31A6143AF7DDEB2D8C4B07ED0953F14CE21D6A2DE42EE17DF9BC49A
                                        SHA-512:FF1CA551559AED3B3B9CC56CD3990FDDBB8108BC1D14D4815A0C9D7827E7AF949CAC0EB3BC9CFDF8D9F828D6DC36939DCF5B056AF6CFB9704B8359E93D61CCF5
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`ocq....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_add978_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.780780761491566
                                        Encrypted:false
                                        SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                        MD5:FDB7A923A84D2AE91457941A8716162B
                                        SHA1:3963DCE734F1B6488518EF65BDE848A9530E5B71
                                        SHA-256:A1AE8A59E432E0DFE23FA3A89C79A623FD915ADECC6EACED365E3A07A36FD72D
                                        SHA-512:3381E62F79697E7DB3DE45C21A5DD1EA50B066630BFCFD955DAFE2FE57538D23BA2692E01BC615E0B0704FA60F913EA909AE04B2077E4A217E28A89870E1B4F6
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x.Y.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_e3ddc9_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.775828967093814
                                        Encrypted:false
                                        SSDEEP:96:4NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:KHm231Nvu+wIqltWOe3nIP
                                        MD5:C4DB516F01FE004D3FAD7BF6E17425CA
                                        SHA1:46642C9DF69A8BF7C1E0F715C2FFD8967AC6AEF4
                                        SHA-256:0CE7A500EE361A1EC37075FE73F5E2DF0B6A11DBFA1F7D22D28C43FCFEC7A467
                                        SHA-512:F51A97EB5146E9297E24EE26C2F565EAD50AA0A066F48BD1F498DBA79112A7C6E08FEE75917ACE908007394E56CAEE8FE83829354A9AF9A1CE80F234C911E75B
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................t.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_f1fd86_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.767179218098146
                                        Encrypted:false
                                        SSDEEP:96:yNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:MHm231Nvu+wIqltWOe3nIP
                                        MD5:C0BDD404E4D2A5D3C93201085ADFD0B2
                                        SHA1:1FC7A4CAFD0C65C1F734AAC20FAD5F41BF92C961
                                        SHA-256:C131DC62CD1046372FFFDA53AC05CD438CFD4AA530D7B043F20E78F5E2732004
                                        SHA-512:F10E3B644C5997767D6B4E4935B3DBC98E3BA3B5CDE69159E8F9231D2BC4DF5113F491BCA0B5087B865B802EF28ABE28A83ECAFCCFAD93C69C6AAA18865E6C2F
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................!......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36696
                                        Entropy (8bit):5.283245047820083
                                        Encrypted:false
                                        SSDEEP:384:iPQnb/+vaW1e073DX9F5fyd9EZDS25ulak:pbGP73DEQDS2G
                                        MD5:6FF4CE9688B7C01F7C6024120887AD65
                                        SHA1:AA741D08DB2E2177B9AB068A038A162D3A9CD518
                                        SHA-256:89237CD26E36F6874167B688F6CBEB6791E9114F91D3B0DC1F4057B86BA478D2
                                        SHA-512:7F4F684205E59419A17918EF1B7A17224BFBB2272C7235AD3DE282039B05ABC0917B07BCFBFA16A87D784EDF1352EB9E6C0CE2913A0D17B621400A77377F0E07
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=453326&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=695649&fcHeader=e3ddc9&iconColorHeader=e3ddc9&bgColorContent=201913&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=9c947c&fcContent=ffffff&iconColorContent=222222&bgColorDefault=1c160d&bgTextureDefault=gloss_wave&bgImgOpacityDefault=20&borderColorDefault=695444&fcDefault=9bcc60&iconColorDefault=9bcc60&bgColorHover=44372c&bgTextureHover=gloss_wave&bgImgOpacityHo

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29661)
                                        Category:dropped
                                        Size (bytes):31467
                                        Entropy (8bit):5.22786442951504
                                        Encrypted:false
                                        SSDEEP:384:iPQnlcR8lOXHc11evaL5mqAnztm8HS1E+4u6GyzqYSc7nfZBhVFWGc:pOXHcEacqYz48Vu6GyzqIBhM
                                        MD5:6152D14CF3B1E5E829032012406AD201
                                        SHA1:7B1FF6FA9E7DDCC93242F7915DEC41B9B096AD58
                                        SHA-256:E01DB16A25EEDA85CBA119C390B95AD68CEEDF00438DCBC63CDCE78F104F3C52
                                        SHA-512:D91D7C3FF083A9EA1FFFD941CCEDED61F778EACD387D77E7B78C06038537217BF450ABC37FF8E63B956E0FD109106C4EFCF4383F2F7399DD5BBF79CAFA2E6683
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=453326&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=695649&fcHeader=e3ddc9&iconColorHeader=e3ddc9&bgColorContent=201913&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=9c947c&fcContent=ffffff&iconColorContent=222222&bgColorDefault=1c160d&bgTextureDefault=gloss_wave&bgImgOpacityDefault=20&borderColorDefault=695444&fcDefault=9bcc60&iconColorDefault=9bcc60&bgColorHover=44372c&bgTextureHover=gloss_wave&bgImgOpacityHo

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1383)
                                        Category:dropped
                                        Size (bytes):18042
                                        Entropy (8bit):5.090247985518859
                                        Encrypted:false
                                        SSDEEP:192:XQJrHDQ1PVPgqMp8MCV9F5fydVPd1EcIVggtHBgmB0iBfT9RhS2wV53skuMaaSQ3:XgPQVDX9F5fyd9EZDS25ulak
                                        MD5:F7BBF6EB933B16269E354E9F219F05CF
                                        SHA1:81997C38A9916E00E235A64E8B2385EAAA5D6F3E
                                        SHA-256:5958C3E54F27C21BF2C6F52B4A2DF5D0D17BB6104EC8076A0F12D78E9B06E279
                                        SHA-512:D3BB37E1084F699D1F51AFD547A78D167F311AE5D2F3ADB7AFB7766892BDB9EBC1B01A75C947A1279A482C870F77DDB654034D31699564228193BA03B2009EC5
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=453326&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=695649&fcHeader=e3ddc9&iconColorHeader=e3ddc9&bgColorContent=201913&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=9c947c&fcContent=ffffff&iconColorContent=222222&bgColorDefault=1c160d&bgTextureDefault=gloss_wave&bgImgOpacityDefault=20&borderColorDefault=695444&fcDefault=9bcc60&iconColorDefault=9bcc60&bgColorHover=44372c&bgTextureHover=gloss_wave&bgImgOpacityHover=30&borderColorHover=9c947c&fcHover=baec7e&iconColorHover=add978&bgColorActive=201913&bgTextureActive=highlight_sof

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_glass_100_f8f8f8_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):324
                                        Entropy (8bit):6.099280043808392
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOku2PPbN1MFwLKUp09SAG2zgN+E3VKF2EMiVAVTp:6v/7JSUAoPhOWAvzS+E3V+2EMiVw9
                                        MD5:43482996F3298BDE3B0C5DA39449BFB2
                                        SHA1:859318FDE99F3D8E3B8D867EA90AC5B46CC96851
                                        SHA-256:E625FD94AF14EBEA9BD79F5F72C4D099B9372199168D0CC09B0C12F731B0A195
                                        SHA-512:3AE92C757E5A61D4973BF096408F54BE091166DC2E4126BBC4C0D766537E16B1B96367A8FB1F6413C16F39ABED00C1B278A63E3318A656E75976C70B2ECDE4D8
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......LIDAT8.c.}...a.."."..?.~.01801.1.|....!..7..C2....d..B...g........;x.....V..58.f....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_glass_35_dddddd_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):323
                                        Entropy (8bit):6.118633877079006
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkKhOp1idiimfIazgN+E3VKF2EMiVAVTp:6v/7JSUUOp1PhAazS+E3V+2EMiVw9
                                        MD5:849013BB9DD833BA0E53560AE101A82A
                                        SHA1:EEC1D9611C6C3790C8F79008A69DE45B841D77E5
                                        SHA-256:73E0C96909304F28CE03CD13929F0D99CF89F939DA3F6F788A6A3FD54C57BE76
                                        SHA-512:EFB376A3BCCFF2A5F11D9BEDBD52AE36C43861A647326738FF5F5018115DFDEBB567BAD12E6C7341E6D87A6D0DE299673EC8DD28BCD663B6813D0D1065AE004D
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......KIDAT8.cx....a.."*....x..r..}dblax ..0..q...?L.s...0<>.......'...y....h( .yA..Rw.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_glass_60_eeeeee_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):323
                                        Entropy (8bit):6.136900547450183
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkKh2vC4mwO3DW2zgN+E3VKF2EMiVAVTp:6v/7JSUU2vCVzzS+E3V+2EMiVw9
                                        MD5:6DBC2DF754AFE0B05C9A1C50AA797C13
                                        SHA1:5703D4E46789D62A9B8F858A728254A91D320911
                                        SHA-256:897B58BC1EC9CAABC0AB95CCEA0EE26FCA10BF9AA7A53D6FC0CBC56A4164D42A
                                        SHA-512:BD2A5DF70345FEDADE86C361CF3D9670365877BAD81F612ECFB201FED93B068AE4009153A5A373EFA408324E2E7A0AD7CB9FFA79D0D5420F3ED301E127C3772E
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......KIDAT8.c.....0.F.........b...b....."..p....'0|......./.c!..._9.......h( .m[._.......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_inset-hard_75_999999_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):310
                                        Entropy (8bit):5.999011311090708
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkiAFl4BK7yRTh4Dag2zgN+E3VKF2EMiVAVTp:6v/7WdUMAfgK7yRTh4Dag2zS+E3V+2Ek
                                        MD5:6767DB53D8EF6F2FBC454B9AF8540601
                                        SHA1:3708375F44492D32A6376BAB4AAAE15E1AD3574E
                                        SHA-256:E2E788B2F4D440B4E4A8B306B81B8AA519994095A3FE7DF78BE1FD139F55D785
                                        SHA-512:568999EB273ED5C9794C539834F964F46CEC0C046810BDB396D07CA15AAEA5445240565BBF5D48AB7DCBD5129F5161DF08677F90EF614CE860973733E3D38E47
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......>IDAT....Q.. .D......5..{.T.2.r.@........JE..u.q....D....E|...zv.;..]n...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_inset-soft_50_c9c9c9_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):329
                                        Entropy (8bit):6.159377583111018
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkjPE+qfyznFF39vzgN+E3VKF2EMiVAVTp:6v/7WdUjnnF19vzS+E3V+2EMiVw9
                                        MD5:06F61468D4C682CF8C40D0B2DE2472C7
                                        SHA1:BC120A19F11521F55AB011EFC54519484296A801
                                        SHA-256:BAD2807409F8E9A151F6316BE68E110504D0C87A3E7D27C692C919C7F382E3CB
                                        SHA-512:1E203FD7BEB683DC5D098362B0DC9B833B1786EA56DBD8045F708E3585662EAE9EE7B7979F11A2FBA86F7D47F2AE22AA45B07D115F1E63467D5FB6CD3BA7D46B
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......QIDAT......0....n.TWd...s..%..Z.....0.$'>y...$4..e.Z...........m7.x.~.v.....)...<......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_3383bb_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7748572558304305
                                        Encrypted:false
                                        SSDEEP:96:hNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:pHm231Nvu+wIqltWOe3nIP
                                        MD5:0787C6BF54A66814873CEE2CCAFA9732
                                        SHA1:D78AA4DD126A140219E5E74F7A1FC188DAE39B8F
                                        SHA-256:77D68A1D57B4D4FD319BBB155BF72FCE8394C9DE6DFB1248FF7BA557580978BE
                                        SHA-512:ED22D62D27DB114053855A9E4FE6EF0AA5B8B1B7F02FA51D4B9EC2F0A213D875291D70CF378F2B062D9F856E651264C7E7F8A60EAEEB2C3C67FC7603D6A32D3C
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3....]....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_454545_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.925434318681863
                                        Encrypted:false
                                        SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                        MD5:5C3BA680CC34CD9B30855C180474A152
                                        SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                        SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                        SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_70b2e1_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7666744210772265
                                        Encrypted:false
                                        SSDEEP:96:BNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:JHm231Nvu+wIqltWOe3nIP
                                        MD5:2BE9B4C61F3F58F52921F7559DADC676
                                        SHA1:C9F6E9C405B4A057B9FDEE94ABC8B30194FFAC84
                                        SHA-256:2C9608B1927D4286185C91E19768EFA3C74116775422FCF75BEE20414B9E3DED
                                        SHA-512:9CD07A4EE9D87F43235591399FF2973FAFB84D4741FAB2CD3016057A3EA56194172AE27EB1C8D679FF406CBB14A7840395AC696B2DC3BD0183ED229BDA978884
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEp..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..ni...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_999999_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7111
                                        Entropy (8bit):7.930568719726226
                                        Encrypted:false
                                        SSDEEP:96:gbwMxnYMuizXrKo/5WqxtAqeHLyq/SFR5Xi34CbgAXHs43bxpMhk+3Amt4Aw+eZH:DMzXuohHkyEW/tCEAXHBg3Uqex
                                        MD5:CC407B338A9351A370F4895DBA384B24
                                        SHA1:42206A8D67AFB9435BFFD1579663EBE1A18AEB29
                                        SHA-256:33F6E407E7B5858DF77AAAC1848B0451FBE494AF507233AFFE381351AFA0421F
                                        SHA-512:9AC2F60405850ABC8CC8AF860C20C6CCF1DEF1E44E91D2D895EE4B14F6D8285E5D3E69F26C0B4E2044C01B2BA9E5142E9C733A8646DA521A75CC422F2418CEC3
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..#^......tIME.....%...'E....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>............d.5..x..^.../.2.........mV..&.@..`..MX9......$)...=.,...0L.L...}.0~z[.....J...5..S.#.G....p_....I;,.:q! `.X% 0.\..C. ].H.....B(T..(..R....o{vX3.)...........6h.>...XhN.^.4.Ab....!CPz%..Lm0..m...m..n....m...9.c.....].=.UL.W..W7..)........6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u.....(.#%$....4`.*.3h...5m..m.......5@.. .~5<.e..........n.oF...|..d{...U.^@...>]..L..-oz.....e..%PE..f......$\..')y8J..^k.._9&.t.;..o2.:....A.......@........px.h8..4..7..:....._+-..s.E.K%.2..5..UA...(.<..`......+P..3l..X..S..G..n%p.U".YR.[..........R...q._`....P.5`..Y.BKl.5b)....Z|.......t.Q.i.E.. Lc.J..t.S...Ch....Jgn.b..(;...Z.-..tVk.n...R71.%.5`j..i..@/...uq...4s.h.`s....... ..]&.Ua.q;].A.....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_fbc856_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.777593739887738
                                        Encrypted:false
                                        SSDEEP:96:yhNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:ypHm231Nvu+wIqltWOe3nIP
                                        MD5:908D7C74656F60D6716E090009B7D21D
                                        SHA1:6D1A63B435DEFFE5B9AC3C74586BAEAE94F2061D
                                        SHA-256:A70457FDC19FA40C6DF794C8184AB93299DD41B0CC2C5210C7CCDFF9969B5231
                                        SHA-512:4FF4F94B1648934F3813913AEC11D86F9F94A219F7D6F682CDEEE4C0FA41BB5016AC4327BD3B32B2973C3F69005A1ADBFF1EDE3754CE6A40CED179FC005D17F8
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..@....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36520
                                        Entropy (8bit):5.277612528633452
                                        Encrypted:false
                                        SSDEEP:192:10OW0O5tb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHQPkvvr:K5tb/+vaW1e07GF5fyqEEDS25Y
                                        MD5:66A05DBB5BAC293CE476E43E7F69A538
                                        SHA1:5B623FE7B333AEF8731B6503A5829924483E3BC4
                                        SHA-256:0D3BA52CCB0BE4E696E0CD7D65C04A51C8476FF8CDF1C988867313CF670B26B6
                                        SHA-512:079907953FC4D5F085D00D6D39E17C4C37DE4AB2C262AB4972D1056CA6C78351647040D101487F0E37EA526FBD60DDB2762D311FD00BD2A77CE8C4C34872C35C
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=dddddd&bgTextureHeader=glass&bgImgOpacityHeader=35&borderColorHeader=bbbbbb&fcHeader=444444&iconColorHeader=999999&bgColorContent=c9c9c9&bgTextureContent=inset_soft&bgImgOpacityContent=50&borderColorContent=aaaaaa&fcContent=333333&iconColorContent=999999&bgColorDefault=eeeeee&bgTextureDefault=glass&bgImgOpacityDefault=60&borderColorDefault=cccccc&fcDefault=3383bb&iconColorDefault=70b2e1&bgColorHover=f8f8f8&bgTextureHover=glass&bgImgOpacityHover=100&bor

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29453)
                                        Category:dropped
                                        Size (bytes):31234
                                        Entropy (8bit):5.219784610390886
                                        Encrypted:false
                                        SSDEEP:384:K5tlcR8lOXHc11evFi1kzqms+4C6GkEtBSc7nfZBhVk:aEXHcE+kzfoC6GkEtfBhm
                                        MD5:CBEAE3A1C196A22080B7FACE12BE6A22
                                        SHA1:F9D0A0CEF0F6F3A1D69C4F06B7E192D1406B7DAE
                                        SHA-256:592C4AB8112A3C45430AE013B3CDD99BDB74EF03FE18C958DF71CCD2ACEA77F5
                                        SHA-512:BA1459D043FC2D60A73D38621AB5CB488BAA8383BE8CF556012A04B1A45733B7F6D1F96BB7293ABF78C44F41CF83C5E398C65FB4D2106E5E0047614C8680D053
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=dddddd&bgTextureHeader=glass&bgImgOpacityHeader=35&borderColorHeader=bbbbbb&fcHeader=444444&iconColorHeader=999999&bgColorContent=c9c9c9&bgTextureContent=inset_soft&bgImgOpacityContent=50&borderColorContent=aaaaaa&fcContent=333333&iconColorContent=999999&bgColorDefault=eeeeee&bgTextureDefault=glass&bgImgOpacityDefault=60&borderColorDefault=cccccc&fcDefault=3383bb&iconColorDefault=70b2e1&bgColorHover=f8f8f8&bgTextureHover=glass&bgImgOpacityHover=100&bor

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1358)
                                        Category:dropped
                                        Size (bytes):17866
                                        Entropy (8bit):5.078458550790552
                                        Encrypted:false
                                        SSDEEP:192:X45UPkvvLGF5fyg53EcO32B+yjgmB0iBfT9RhS2wV53skuMaaSQhQz0iIh20:X45aF5fyqEEDS25Y
                                        MD5:1DD5554BA234E75BF2BA13CBA7DE2FFD
                                        SHA1:77D8E0898C772D0F478C912C12FDB10299C26E23
                                        SHA-256:92F063EF8E21FEE9BD792812BC72407F4D55F81AEBAD6668B7BEE9B0C8C786B5
                                        SHA-512:26DD2069EAC13D9F4262EE6998944EFF6152C7DB06B69F8198A4301B39723CB7BEC4FED3A36B906A0451912A737B97EF53F86F1E08F465B49AF59AA818DE6383
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=dddddd&bgTextureHeader=glass&bgImgOpacityHeader=35&borderColorHeader=bbbbbb&fcHeader=444444&iconColorHeader=999999&bgColorContent=c9c9c9&bgTextureContent=inset_soft&bgImgOpacityContent=50&borderColorContent=aaaaaa&fcContent=333333&iconColorContent=999999&bgColorDefault=eeeeee&bgTextureDefault=glass&bgImgOpacityDefault=60&borderColorDefault=cccccc&fcDefault=3383bb&iconColorDefault=70b2e1&bgColorHover=f8f8f8&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=bbbbbb&fcHover=599fcf&iconColorHover=3383bb&bgColorActive=999999&bgTextureActive=inset_hard&bgImgOpacity

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_diagonal-maze_20_6e4f1c_10x10.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 10, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):354
                                        Entropy (8bit):6.1856798088703915
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPIMUyKfp5EjkIEFFU8agLyACE1jAtyfzgN+E3VKF2EMiVAVTp:6v/7AMU9+mU8aEyaAtyfzS+E3V+2EMiw
                                        MD5:8E54CFD7DE41844B11EBA7D8C6A0D190
                                        SHA1:E42F0848BD4702483EC12830B17F16D52AEE446C
                                        SHA-256:21CD36B1BA6C9F13E4FCCEAA0181DD9F93859C49CB99402F82EBF622AB5500C9
                                        SHA-512:314F99E71C85952B876E0014E654F849D6D13F7CAC753607B2755BDB4B9579008867CF93559B4E39E5AA96EFAFA16B6E45CCA03C41A195A700A1425DB95E67BA
                                        Malicious:false
                                        Preview:.PNG........IHDR.............R.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".......fIDAT(.c......a`````..+.W....w......8D..<m..&d......6...2.....ga...F.t6...........G...W.c.A .p.<."5..*..m.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_diagonal-maze_40_000000_10x10.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 10, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):301
                                        Entropy (8bit):5.8094407899272555
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPEpFMUyKOkYmF+v6ZOatLzgN+E3VKF2EMiVAVTp:6v/7YFMUOmF+6TzS+E3V+2EMiVw9
                                        MD5:FEBF32D7E54EEB847E50A642AC71164F
                                        SHA1:655D6D8E685ABF751B93F90E7DA27A11ADAE8CA2
                                        SHA-256:8D123AB9E67782510FA4B8E6880C4475E925298603EC85FFCB2E2B1D0D13D57E
                                        SHA-512:E2C3F9D7642CA4807A7944496B6003D0E2891C2AE8B13CD1911F9571DC56D6F55C45C52D494BDF9E00A8E0CDFCD96B00C0AB642664A2DEFB47EF1570B950CCFC
                                        Malicious:false
                                        Preview:.PNG........IHDR...............L"....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......5IDAT..c````0Nc`@..i..`..,TU...i.!&4-.gg..n...P..E...c..&.A.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_10_eceadf_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):10817
                                        Entropy (8bit):7.975179355860076
                                        Encrypted:false
                                        SSDEEP:192:5m0I5zL5Wt7yuMsf0OoCB+05Sn8erfrZanjySFjhGp89G:olv89yPs/U8oTZPyhhQ
                                        MD5:DAA0366C4F4C1E13878D2E6229FBED41
                                        SHA1:45C336830C04472C6746F5B8BB8142249E209C3E
                                        SHA-256:B3499F4966F2118AED9858D3119598000A0656738D0212ED26585692A5734799
                                        SHA-512:753D2A3E627D9622209744835D277C5407542C88AD30E330D727059E23CB37401541E09D21A2A6EF28C2DDBA3A7B25F0EE4608AD555380D6CAAC4E652488D4F5
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......)EIDATx.}\y......vE..E...T..B.....&.3.3.R"./..,v..64(N.2..d.t..d.j.z.z....n..o..........g.{....G...?<oxx$...........3U.j...>.....!...{.L...E6.............[.0._4._...B.P%tt..n..f..k.p;.VRA.....X.2(..O.J..9....].CS......j-...........*T......[...cA...&......~5..m.;....=b.j..U....o...UL.3....D[V..?..:G......IY......[..."...{.......kx-.A.Eo..=H.T.l8.~.)q..#u.m.zT.....A;.f..J..8.a..vn.)o.~.....,[Y7.5.g..{...|a>....._.^...)n..C.p..o....}zg............V.N]..."f.).;..>cg.b.>.vf]....GB..%.....ei.B[.K.I..I_.7.3d.."....hvS.........H.[......W.#.W..u..E...._...iYE....v...4......c.hs.<].7....W...u............w.T4..7.?.;Egq.....Yhn.W.jv)..-..=jn1%..Jx5d....8.M..B..(....P;.V....#B6n....ri/..T=...@..*8.q....T@.. ...B.........qw.=.6..GT#u...>...oqJ......7.mS...CW....v....d.zIM.M..9Y.a.YD..*.A.Q...\..un..d....-<.T3W..X.&K....v..H..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_10_f8f7f6_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):9962
                                        Entropy (8bit):7.969618322180041
                                        Encrypted:false
                                        SSDEEP:192:5vfrOe0KqRDuvFYV/XAberk2b5wtdT79tYGd/gogGVnP:x6e0LavCV/XSCkVd31/i8P
                                        MD5:9224F99A2486AA6685BAAE76771E1EA9
                                        SHA1:BC890EB71B1B0BA6A2E83C68E9AB531943E7579E
                                        SHA-256:C38192FDF2C50DCC11C75619E36D7A70B2E42A80988A5BA3540C7A86594D5D99
                                        SHA-512:92A60B05866D1E66F1E8E0BD4ED14DEC5450564C6ABD9CF105FCB20EAE2EAC38DE12E1296943CC3C97FBEFD43B50177F6387FFCE0BFDFCE38724BCF85683B0CE
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......%.IDATx.|i............J....T.82.pe.d..D........("..E....A.. ....8!.Q_...j.......buw..c.|_..`...8....]].k..^......}7......'.O..f.y..R...*../.m|G...W..y...z.F=h7....e..\"...p......c..di.F...f..l.-.n.n...........l..j.R/.E=.X3.......r..&..?...8....R.......}...X.$...z....Z..l.<.}....rs...-....[..........=*. .........O.V.C.s.J.....YO....~..TDE4....>:..R...o.["[......j..<.3..z...7.z. A..a{.fuo}..._...{.A...`.=.^ ..........42..cf.....H.d.3.:.j{..J.h........l0....r..U....f...b.1d.....toQ[jG..|..|.....~.]...zi...u....SL..^........xa..o.{.W. .Ut..1......{s.i`.a.-Y.....D=i.-..i;..z..O..mmO{3/mw.Z7.....K..?....L.U.Q....J..]W>..Z1....l.tcfw.S.2...).Y%/..Q.)%.N5.l.mZ.5..b'......k+Z.:V.S.(_.....f.m...e...wU......~S.}...~..*....?...'.3.).Y%/f.U\\~Y...e_../m..\..O.ckW.#s....r...([.^...kU.5..7.-.........PR).R.u......J\...x

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_15_eceadf_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):10587
                                        Entropy (8bit):7.970596955089787
                                        Encrypted:false
                                        SSDEEP:192:5LS2mq5Hlu+29ey/FtpAemynhbcA+XQ6nqrpm4owj9euLJcblTr85ABrA8pyCyj+:d3G+U5FtBnhbcAx6nz4ow7q/85OAgyCF
                                        MD5:1573724BC760CA865BC89E04AFFB7A8B
                                        SHA1:82BEFD0ADF9B01AE7D23D3FA523B1BA977C07670
                                        SHA-256:4025C124783C830B3125FDA65E78CD732D51DB58C451C576A0F41B269DA8BB0D
                                        SHA-512:6249A5BEAF3387F2607AAFA6B905D8EFE62A3227518803CE67314983FF0613094614621DB3E6EFA8E287C6667CF3A8711EDA54EDF58A3ACE8BE920CE717AF6F2
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......(_IDATx.\y......w.Y.(.ET..B...L..6.d/D"..:.9...r..XC.d.Fs."EB8...#....>....u=s..u..........{...s.../<p.Ea[]I......g..]...^o.xG..SK.:.b9,..."_...t%}..9...I.j%..Z...0..c..j......Bo...;._...r.l{.U"w.........SE.....S....Mw....ac..9R.j.iU.sq$..u......to.......9.....g..A.....G.==.;........}...tg'../.w......o.ZN..(J.........Y..Z......W.$..4M^e..s./.....:..+.@wP..d.~..j."..V.-I.......,..-E..........e...)._....\...J.. ...{.9..`.8"v...p7..a.X9v.[.-q..[.....'..gp.......:?9[.ZP......'.a.8.k.....4.5...V.8y.-a...>....wop/9wXoX....1E...&....<h/.V..#._..o..|<D.o..'.~^3..:.\R....&.Q..1<...9..K............5....j..u......b!LG.'...Qo.7....w.8?...~......^...M.e.X....v.{.......................w...q5..K:..j.....w_t.w............ ,~......1Et..r.|..f.XW.S.T.C=....X.rM+N.$c.oU.UW...n..{U..nuf1..Z..#p......'(.W._.\....V.\...^.W..T.....N|.....[

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_15_f7f3de_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):10949
                                        Entropy (8bit):7.975286464162133
                                        Encrypted:false
                                        SSDEEP:192:5Lf8jio4bI9ZPFf6lmEeBKELlTqD6cfkZVw2GIqmn+Pem+uegXG3:FI9Zh6lmpcKlTqWOkZZwcOeXubm
                                        MD5:0692EBD90503C937C0CC42F314B217E0
                                        SHA1:90775634877E018BDE5CCEBB299020173E5EF4CF
                                        SHA-256:12C9647B8E4802BC5D9446AB0CD00E717A679C5F3058F958A1EEEC5571059AC1
                                        SHA-512:1981023F51D335118F6A7F537C3A09193F2B00DEA453BFAA67C5C2D209B57C24AF339004029FD9F05AFC300FEC2C9F845F33C845077AF329B276C08CBCB76962
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......).IDATx.|{.U....>..0).9. .h..LBD.RD..B....8.......%...qHD......IB..3..>....Y..K~.....z|.......Y...-.[.5*l..j.o.....%..+.#z.~O.....QS=.^RJ...i.U.:/..tL.EMq-...|.B....~.CDD..."54...I.........s..uN..j......S9....e...Oy..`F......:...d.bU.g./Y..&]..:.....Q.G.L...v.t....r.n..;....>AA0....=...S....7......s.D..p.O..y.......t...i.._Y...._V-...".wov1{Mw....x.FPm.J.....q2........q5.E.Sl...a9N..g!.0W7.sZ......r%...H..rO..Gm.1....0..ZU-O......<..J...&o.[+.1.....n....%T0....q.r..P..~.w.. -..E.v.....g...K....4.f."1O....Bo.{..;..!.S....W^.w&D..V.`|...cr..........A#...&.@}.n...r....i...]..voK........a..+~cw.5..d-.{.6..TGR/...F..z......hqx.8=j...8oA(.S#.8Z%|!...A../_....`.....S.).....C^...Wc.............'..2..v..&'.r...(#\.j...vS...zP7._US.P..x..I...4.....~..:.2..=.~....3....(sF;...B.8m...A.........h.}B....."...H.tM.S6.)t

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_15_ffffff_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):4262
                                        Entropy (8bit):7.870900539604215
                                        Encrypted:false
                                        SSDEEP:96:qcNc3q3cwzxGSqXP5iizWuPWmaDWrdZdoYuc:qV63c46XUiymTdZdNl
                                        MD5:CAB25AF5D888E338ABF8830001268063
                                        SHA1:266CDB929DE208EB666459B21E1A698403602502
                                        SHA-256:406BF03A738DF2A719785300DE43D73C8DE06C51F770A287E96C77369289FED3
                                        SHA-512:BB55B80BBE7709A564262CCF32BD42EF9EAE25ADC771158C0088F0401EB6AF0E76CFE458BD5FD2419B6AD647E04D1D78C90D174D8746B7A8FBEC6C8D4D8F6E3D
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<.....O.Z.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDATX.mY_.,.Y.s...s...E|Q.....&...Z.$.2!.(1.<..]P..>:.a..."....y..E..e.$B. ...........b.....A..z.....7s.F...9..Tw}...}..N+2@*..C.1.@.S............`.-F._.t55nH=..:.SO........".d\....@...3.R.-[..Y.=.qO.7p&..J2.......>.K.[..o.2...@.......9.Y.q..,...(.X.=.Y*...I}Z....#g......R....(?G.5u...-...M=m.>j.K......|..c.D.8..:...&.`.j2...D.T..>.Y...&....:.........'..Q.u.....}.......5[ .!.w@h.......J..Eh.4Y.Z..c*1....Q..2dX......gn`...#.....c..L.Z..}...1............:.K.VX..........0..W7D..o)O=kW{.j.X..RE.(....T..k..kj...D..Gv..m...S.Y...r2..P..2.R~:... .......:j..,t:.r.R.Jo...lS....0..3.)w...r...X... ..N..0../.R..@.../.m\......j...[*..-...V..........R...$..8.....ApA&..5.%..-[_....b.......n......."....;w?..+u....Z~.?|....u.....Wn...v....7?...O.|Xm......{...+...#.&~E.K...#..U..G..w..._B{......+.p..!...K..6..<c.z.P.1..Df.B....gn

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_65_654b24_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):14498
                                        Entropy (8bit):7.981807801007253
                                        Encrypted:false
                                        SSDEEP:384:W6r9F7HYHPQlAq0izgtUYKO6OH61y7On6mbbvb:hr77jlXMtUmzEcO6ST
                                        MD5:0DA5C3834D6BE7BE8626B10311D7D42F
                                        SHA1:79495C88AD23AE852925658F05858128F5B8F9DD
                                        SHA-256:861A442B54D565C15E61A9BB056223B2D21A2E7ED7C245A9A2E701CFE55F9BD1
                                        SHA-512:F6D61966E32F737F182A8A91C5729E615691E1FDBE30391D72B9198D41BE2ADF353FFFEED510DEAD0905271830D71ABA88CE267D1D7F4F1CCE06D2505C4174A6
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......7.IDATx.u|wx.........7.BG.$."..HG....AE.E.EAA.Q@.....!D...*.'$!=....3....|.{.>.Z6.S.=.=.y.......3.=}.9`..l.V.9T.....-..#N..V.}.$K/...H...(....B.a..'.j%...ot.T....*|..B.... .m:n.L.v.e.N.u.ehr...L..4>|.EQ).j....>f...--..)ldR.bZ.h.6.~...U_........|.(e.a%.2.|A.........wg|.Od~.qg>..Pc*.F.}...+\W..x.....~..OF......).....|.s...."..Wh..[......+z1..C..K.....#m.r[....X.L.sA..-..1./.....W.a."5..F9h.~..uxR..e../....*.s..p..Hz$di.g....}.....6. &S'..&...././W_.gS...M-Y6GB.(WF.....:.P..o] T.$..k-.'.T....N~..}...'y>.-f..4:.'..F>`...4:i{..h,:.,Je4!...K...../.K.m...V...%D)1...=t....y..6?~.,....QX.n.?...^......W*~5!._......=.X'...S../......gBF.O.-.F{Z..m.6M;%>.\..!?.}.(..C...d...!../..j[.lR.7:......U..9k..+.-.=+.....B.f.p.2r..P..e.m...f.Z{C;,....P../.b.P.....C:..U..7.nC.$..w......]...D.x>..d..L....r.B....~..2. \....5.4..'....l.!......x

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_68_b83400_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):11935
                                        Entropy (8bit):7.974771171812448
                                        Encrypted:false
                                        SSDEEP:192:5808KiNNatDpFdo+f5vdIEzqTq+QNzNkb6JeW4aDD73XIR/hC05uJz8jlhAT9/E6:sratVFdoy7qTq+QV26J/4a/73XItxCoi
                                        MD5:A020D1BCD94211F5586B0F8E9F2EF0C0
                                        SHA1:3967D2426F4BB056314ED6B98913101EE87CC77B
                                        SHA-256:6F34FCC0397A1751505283E1FF893CA6A8755578B2A7C20737B037C74718D6BD
                                        SHA-512:ABE69894EE57DEC8F0EDF00BD3F7FFD85AE4CA87EE45A6C87E404ECE01514BBCE3F3BAF2EBCF08EF0B198CD182EE5E8CF3058F17B5DB2B3A0721754B97C90B95
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......-.IDATx.|itSU...7I37I.y..2..B..... ......# .8 .A.Qdx_.'F......ED...R....M.4.xo...q...{...GWVrs.9......;...;.|...\._.....>.T........i.p..5......I.tB..z..T,|.4r....Wt.,+.....5x..B....t.{N[~..%..t..X.......;_l.W........rr....T.F.Z|,..0.im.4....=/...u..S.uvZ..Jr....H~?wc..0$n.w..s.....iG....`G...V...:.|.9.......5Miy.....=/55..wF..>7..I.E.6.1y.:....../G..n....:........=c.p........pG0C.\..!....;.w.pK.%...D*1.m...\.X....h..m..-.U.q..GS..M.:{....`."oc|\s...3.sz. ...t..x...l..`.T...^;.M...k...Ew.....T.F..n(?..&..K.\.pg.b.....u{...W*.........x...%....Ll.x-.h...Z..<c]....b.P.+.......<Q.. .8v$x.W:.C.......r...P.../..../.X.|.r.sR.;..8Z.....V.oZ$..4.........Ri....d.V......{..x$l....ox.y.`{m.X...&.#.....-...=-..4..HR`...\Pq^2*ST'..y....2O.#f...Z<^..\.:!8..N.q....." ......x..N*O.>.R..r..)H.Xl.R.|RF^%.{Dsx...;.3.V.KH.......G

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_3572ac_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773976636383107
                                        Encrypted:false
                                        SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                        MD5:6050985BF56D772CAFD9CBBCF250A1C6
                                        SHA1:DECC56F1C9D6EF03F460AA3C05501F832200B974
                                        SHA-256:827F9976FC547BE3ED6E1C4D26EBBF29541A6622DF34BB54D93099D5D6B3A89C
                                        SHA-512:167D88C7375DB41B0D39AE27A6C96269B0A251711BC807856F0CCE953A525A9FAB87D08256FC917668F5D215C3EA5D2E396CE8F8D4F53C4BD61F5F742C819FD2
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r....#...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_8c291d_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.782986442029293
                                        Encrypted:false
                                        SSDEEP:96:vpNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:vxHm231Nvu+wIqltWOe3nIP
                                        MD5:48EB999570CAD20502F8E097D5EB06E5
                                        SHA1:5971D205A8D5D3998D0CC9324FF96B89D32574A1
                                        SHA-256:A7EFC92E8E7DF84F638AA5F70E885D980B021B395A34848F018D02E88136B660
                                        SHA-512:59D6EA123399B752374D9EDD8D50D9EAC0BA08DE098F9D9C4FA6D2C46DDA4F5AE2164B81BE930C6A189035FC84C24069305DD558B5BF1A3C0B2A36C7B1430CE8
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)...]....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_b83400_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.746555948985092
                                        Encrypted:false
                                        SSDEEP:96:sVNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:slHm231Nvu+wIqltWOe3nIP
                                        MD5:95EF27B1709696916D21651EE58D3DD1
                                        SHA1:355755432E0AF2450681FBE77D87D41858C0DC2D
                                        SHA-256:7FD672DDF99D36C9429B78B8D16D579E917B9894C0686C171C3EDC568A0F14B0
                                        SHA-512:9274CC96C95E84427C9E71B5EC476D916489CA113B53D3163E7D8AD6E6499A042F18FA584651418F3A446FCF9550D7886FC700BD730F00FB25F1C618F27CF85F
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4.R).....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_fbdb93_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.776149396506033
                                        Encrypted:false
                                        SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                        MD5:4A74B78D6A9AA2A787E1CFBECFEFF7D7
                                        SHA1:8CF70518D6D29FB3D57EE0B6A861308DA6B33383
                                        SHA-256:3CABBFCE55BAB5BA6DA058F7BADD6EB850BB2C9F3482B985CCC2E91D52F52229
                                        SHA-512:E95BD2A3BC0FE051FFB1537DEBAED206309409B910502E40FF918A62FA55080FD2E134610BF7EAC483D8AA6D3CC93B9892FB3903B41A47426F7DA38D8C6D744F
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...............................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36780
                                        Entropy (8bit):5.285425649734029
                                        Encrypted:false
                                        SSDEEP:192:10OW0PLNI85HdOTb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEUw:z5I8RdSb/+vaW1e07nF5fyMhECDS25W
                                        MD5:505163E1FD8778CDEC401940391F247E
                                        SHA1:9B456B5EB491691D00BF416A11A6F138D55F57A5
                                        SHA-256:A44FC0FC779DA7F50050C20F425F729862127783851E4D7C14C7611739C43E1F
                                        SHA-512:E28B9C3DF796B76AB02BC1CF871B317286E5E2C5C1E381A60CE8D2B81CC0179824F5161ECF812ED33A1692E78A41731CC8A4031F67D7C7D4A7822F4FD82AA681
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ffffff&bgTextureHeader=fine_grain&bgImgOpacityHeader=15&borderColorHeader=d4d1bf&fcHeader=453821&iconColorHeader=b83400&bgColorContent=eceadf&bgTextureContent=fine_grain&bgImgOpacityContent=10&borderColorContent=d9d6c4&fcContent=1f1f1f&iconColorContent=222222&bgColorDefault=f8f7f6&bgTextureDefault=fine_grain&bgImgOpacityDefault=10&borderColorDefault=cbc7bd&fcDefault=654b24&iconColorDefault=b83400&bgColorHover=654b24&bgTextureHover=fine_grain&bgI

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29724)
                                        Category:dropped
                                        Size (bytes):31557
                                        Entropy (8bit):5.2301095862972256
                                        Encrypted:false
                                        SSDEEP:384:z5I8RdSlcR8lOXHc11evF2XHzkmBGQv+4v6GpqrrSc7nfZBhVk4:K8VXHcE6Hz1BGQLv6GpqrNBha4
                                        MD5:477009769654FEE8AC7335A90907F54E
                                        SHA1:E533C54D97DC5DC0D24D4BD917A7F08AEF66C876
                                        SHA-256:E3B11AEBD7510C45AEBB9BE978D021B86789C55866FAFA75786147EDD5B9B77E
                                        SHA-512:D170673AF46C6A34A6F1B9E4FF57C5D4289FD0672E0392F65D0023E0AF61DD940F0EC46742E298BDDA96AF3FC3744B2FAB6E33A8E791DF86BE984CC6A2444684
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ffffff&bgTextureHeader=fine_grain&bgImgOpacityHeader=15&borderColorHeader=d4d1bf&fcHeader=453821&iconColorHeader=b83400&bgColorContent=eceadf&bgTextureContent=fine_grain&bgImgOpacityContent=10&borderColorContent=d9d6c4&fcContent=1f1f1f&iconColorContent=222222&bgColorDefault=f8f7f6&bgTextureDefault=fine_grain&bgImgOpacityDefault=10&borderColorDefault=cbc7bd&fcDefault=654b24&iconColorDefault=b83400&bgColorHover=654b24&bgTextureHover=fine_grain&bgI

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1410)
                                        Category:dropped
                                        Size (bytes):18126
                                        Entropy (8bit):5.0950206722906195
                                        Encrypted:false
                                        SSDEEP:192:XRLNI85HdOrSedRvx/F5fyuoUaOEcIupn04HgmB0iBfT9RhS2wV53skuMaaSQhQS:XR5I8RdmF5fyMhECDS25W
                                        MD5:66DFCE3BD59F9B4E02FB34F63B209642
                                        SHA1:5326286217E45DE7ED7FED98EE5404C0D740B485
                                        SHA-256:72A8BDCC98DFD935809EA7037022AAC9E39B23A43B6E2C8563986B64AC5D231D
                                        SHA-512:14C199579958ED774A376BA83ED45F24CC35079D7E28F7AC7BA0A7703875A498DAF261E9990960C0E2C565A56A2ED66C06E33B6122B4C45C33D9E5A30FA9F63C
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ffffff&bgTextureHeader=fine_grain&bgImgOpacityHeader=15&borderColorHeader=d4d1bf&fcHeader=453821&iconColorHeader=b83400&bgColorContent=eceadf&bgTextureContent=fine_grain&bgImgOpacityContent=10&borderColorContent=d9d6c4&fcContent=1f1f1f&iconColorContent=222222&bgColorDefault=f8f7f6&bgTextureDefault=fine_grain&bgImgOpacityDefault=10&borderColorDefault=cbc7bd&fcDefault=654b24&iconColorDefault=b83400&bgColorHover=654b24&bgTextureHover=fine_grain&bgImgOpacityHover=65&borderColorHover=654b24&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=eceadf&bgTextureActive=fi

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_glass_75_d0e5f5_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):394
                                        Entropy (8bit):6.531973512673736
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+WT/RtUFoUkxfx8dj8f5B2zS+Em63KEMlOX:krr9+i5tUFw8dAf2zjEmdEMlOX
                                        MD5:EB83AEB42FD8D8F74C93B391951BCF44
                                        SHA1:80EAEC927C8AFAA6C7E737CFF9B3511B5D1163CA
                                        SHA-256:B88090516DF43FC1D344ECD886301DB6A3EF7BB4FED3E0F654D79AADDBBA6F22
                                        SHA-512:C93C1DE7F09C51273B5A6D70E55288806BCF4CA373B67238DFC565C211893BFE29C5208568852B113093A32FEC1EEA26F0C6A9D3DCFE17D6D3B98EBFACFFF4D9
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH..............I3. .l.&.t..+h.D.u....)..9.v.....O..M_..}_U.. ....<...4.FSu.!;Fv...k.....-.\/R.T......r..)...1.r|d..&e....+.V.6..... ..o.'t.+.`...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_glass_85_dfeffc_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):399
                                        Entropy (8bit):6.554533150250573
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+FVMhhYjbXrsCLzS+Em63KEMlOX:krr9+nYEXVLzjEmdEMlOX
                                        MD5:A697D8FD8A5ADBDB87FAF8D78A90E755
                                        SHA1:382755716BE10E2AEBAE2BD84711861CE687DC58
                                        SHA-256:D868C700B7693AAC8374D6C42569AD8FFCCC35A8F16B534EF6EC72886C9EA174
                                        SHA-512:661D532794A11ED85E87753FF1252594BBE8A5385D8D55910E0E6E5377B211DFBEE8EEB3ED7F7D105DDC20BCE4C8329D5527F1D13A5E137EE40431D6D85BA81B
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...!....G..... ......M.a.X..;....v..b4...ZD.....6l...~..Gr.J...q...p..iQp..FeM...#k..lLL [.......}/...N.I...g;.W.l..lb1.7..9M....q......'.l.#...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_glass_95_fef1ec_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):390
                                        Entropy (8bit):6.486146272952941
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+Awk1em+2vEKvEA2zS+Em63KEMlOX:krr9+JAvEJA2zjEmdEMlOX
                                        MD5:D699723AF8436EBA22B885328314BD55
                                        SHA1:E98D44337839A92BFB993E56837CAAF0E0BD0CF6
                                        SHA-256:F3F6CE30DA7D2A7F442379FF3626F3252A67FB874A3F7304B0751AA7157EFAEF
                                        SHA-512:0647A00337946FC123B57A842267DEBCDD4CCC34346283CD4B43D2A777E308164991CBE72447F191CFAE424A44CF1AAD9DCEE6B6023214C84CA67D2C8D5149BB
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH.....a........\!V....J#X.....D}.....f.>....>...P..x...x......q....u...q...f.+..6....[..\.......W.T4r...6:.]V:...,.(....8..y.G-(d...H...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_gloss-wave_55_5c9ccc_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5882
                                        Entropy (8bit):7.694397536982677
                                        Encrypted:false
                                        SSDEEP:96:fHVCXcDHxneFLdekEyCcsZ8rj/iGyUS6hpYJ/wEl89vw9Xdewx2vVI8n2RKvrogF:PVCixcLzNtlCvUSn1lQgXd3EKWDvV
                                        MD5:C56BA853727C57C51AB90B9E27F7F2D3
                                        SHA1:4D505484B4A7E3611696C792846BFFAEAFAA8CB0
                                        SHA-256:7A405954C99E375B7831162EFABB9D8814913E928F79CE1C5E641AB62EE05B11
                                        SHA-512:428746347A051C02D27A7A6CA3CADD9301F90E58C0DD48EBA7F179A4E28AAD12771081959D5DBD14911643078773859B6FA623414B5B327D58BE5077340D4F00
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx..O.].]..}~..R..Q;."YZQ7..*.H,B.....L...B.(R.......... ..Dd^........t.ph.......#`uSU..,.$......s...|...........3s..../_..s......&.l.........q.....X.........l........6......k..w.....5..;.............`.`.........q.....X.........l........6......k..w.....5..;.............`.`..........qo..v.._O..[/.l_OYHE..Iy...S#..<.:..J...o..J-}\.qy....dVQL.Q....FS9y..k9u.......o,C.}..r..z...}.Q..C....ztz+.wK..r.J.....&...m..+WU..d...[l.}.]...P.....`.<Ge.a'...w...$e.ne.jx}S..w...qrm+...*...s4N....7j..z......%..O-.yy.k.d.h.7...!o.J..r.m;u._)..y.7...[.JF.7"{5.Z...k9..|.......2......`.."..W.......X.T......5..;......0o....l./.c.....BW._._.o'U&.c..jE..|..*.UJO.u]g]I%Gzw..QZW|Hy..[S......j.Y..W..ny......k....G.w....+R.9P.-.+/wy.#:..(.?x.:}..[=......8Y.....[.wA..*//..%K.r%..1.....j..co}....i.o......./._.oAo.....G..<....M*:

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_inset-hard_100_f5f8f9_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):391
                                        Entropy (8bit):6.49868315999616
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+M8YprWjpErHohKzS+Em63KEMlOX:no19+gijpE00zjEmdEMlOX
                                        MD5:EB961B27BE02A26AF523A68D5774AA6B
                                        SHA1:711A6C424D8C5F030B20200616D5DE0716BEEC04
                                        SHA-256:F6AF17A4397C4302D2AB2FC227B04C185412B7AC1AEFF7E23DF7E42375CADF94
                                        SHA-512:5B925A2E924F10003753A12D9BD4BE126BF077FBDACE0591A7450FD2FB500B363549BF05B8E84AE8B1AECB822E70C87170D41446CB6DEA09D8BA12D8F68C6955
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDAT(...!..q......&.h4I7.M0.;.....o#..I...........3_A. =.!.BU.../..i;...)#!a.|..p!...u$........M-.&.....[...........!v.O...h@_hP.V.mu...o6=.9A....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_inset-hard_100_fcfdfd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):350
                                        Entropy (8bit):6.206000010177241
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5Em3MFQ3fK3B6tTLpM52zgN+Em6hp/KEMlOZp:6v/7WogU9+C0MtTLJzS+Em63KEMlOX
                                        MD5:63B926C3D199D7774678EC2F1CFEB44A
                                        SHA1:60483976063220F6BFC4508287E98522312EE277
                                        SHA-256:0AE17677A06192D5114347DE45ED6C6F2C3A660C1202AA6EA44E12BFCE7AFE5D
                                        SHA-512:7BE4D05ACD6519F4892F63C0D8F31E4AA6DC3DAA0467B9F93F2B3C3653A87C1CFCEFD267BA03A137EB110C7197F526ED8A03C227ACEB06D2F63787708F103AEE
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...bIDAT(...1..0....`.JE... (z....BHm.......u....~..5w}."....^,..bcb.$..A"..H...V.A,npC...xQ!T..ry.D...H{*1...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_217bc0_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.771544173244556
                                        Encrypted:false
                                        SSDEEP:96:tNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:9Hm231Nvu+wIqltWOe3nIP
                                        MD5:33AEDE1050C87FAF490EE203D3D47699
                                        SHA1:3C5BF5F8F2C247D6054BB159A5D917FD8C451C01
                                        SHA-256:00D56BB88843D18972E22608E62E879030C321B2DE8891AF2E1D819535570ADE
                                        SHA-512:900C386ADBC961DCB12F5505C599506BF4C4D75883FF6FA9C524499F1F839C9033A9DB69EF9F6E876CEAA24F7A9D5865E263BB4828D3C0C68BAA2F0629B7EE02
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{........ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_2e83ff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.770844676212274
                                        Encrypted:false
                                        SSDEEP:96:aNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:UHm231Nvu+wIqltWOe3nIP
                                        MD5:DB3B908BD060C6F278FDE9E11B3B94E3
                                        SHA1:3F4A9C46377EECDE2C1368EF2B963712B8DF5C75
                                        SHA-256:CA8FB2EB9A086B0C170EB61317C91138EC06EA0FEF878B8E24D1F50BF6AF2A17
                                        SHA-512:9D27F0E66856343254B4C75969B47B3EBACCD95E63981F18472563D95CB85AE3A1A286187F25DA0AF0996E5C783B8807BABC6C7C6698A180175B06C31A949488
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................).:w...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_469bdd_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.772511909269724
                                        Encrypted:false
                                        SSDEEP:96:ENbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:OHm231Nvu+wIqltWOe3nIP
                                        MD5:ED2F2BA37982B5F821D46811A5F79836
                                        SHA1:CB5A57E11754974C65747E3617E119CD1F0A31BC
                                        SHA-256:4C7B9E02B3795BEAC99A86532240ECD9FFEAB750769B1E7EB3A3B3CCCED57134
                                        SHA-512:4C3C10EE9D1A6C0201561548594D673C77919BD9C0435B8655548F280892DDD046FD41A3F12A20DF046E98DF84F5C831EFEA53FCE7FA583FBF76BBC10EA36F54
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEF..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F....c....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_6da8d5_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7780236195661985
                                        Encrypted:false
                                        SSDEEP:96:jrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrX:jrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrX
                                        MD5:72019F22CBCF7555F4BC97AA383F164F
                                        SHA1:E26300462491C199D854B4F60E123D2091111FFA
                                        SHA-256:A3C75E0F64A223773AD58FA87037A924F12C179394FDBFA1754EF38D50976F42
                                        SHA-512:DA05D87F8F767A983953A235AE33C3A4097BC8E3626E18FD4C145A3D6902FCBAE6AB3B6EFA925EAC8932F29176763A9F602552950250BF4878A3B50B2A889251
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEm..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..z.6....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_cd0a0a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739814671431308
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                        SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                        SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                        SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_d8e7f3_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773667817462664
                                        Encrypted:false
                                        SSDEEP:96:3NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:vHm231Nvu+wIqltWOe3nIP
                                        MD5:06F311C437236B376B247382BF815C71
                                        SHA1:110DB3851E725E1CD30D73D292201A6699344E4F
                                        SHA-256:061647E5266E0E229DEAC8AAA16D839EE64DA5C0E7B972948DAC3D071D27F547
                                        SHA-512:C90F60977BCEBDA00CE1D77748A3E2C4F53D9526B867537143D3137E4134858F2C02D45F5521699EE0EAFF6AE4D54C4217714D75E902D89D45EB8826ED51D7A0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................e....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_f9bd01_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.755062961745714
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:C34E7954FB08D6D72348B49032DC4876
                                        SHA1:520468AC13D56C1F347A16DB73003C414C102F56
                                        SHA-256:AACA89AA0E8E287A167FBE6108876C274643080BE32C4A33BDED73BC8F970111
                                        SHA-512:E3DE7AC662DB301C7621AB4D428EDA5398B273D57DF43B449ADECDE1B24ED0171DD6226BACB25C7DAA248533EA2D88F9342B5330F2A8AAB1006662A8EB447A38
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...............................................................................................................................................................................................................................................................................................................-...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36609
                                        Entropy (8bit):5.277735665991303
                                        Encrypted:false
                                        SSDEEP:384:6NAnb/+vaW1e07DVsF5fy6EsDS25Vc6Kvlak:SAbGP7DVQDS2vc6Kr
                                        MD5:F9C03B772B04F821D5DF95A7E978F0FA
                                        SHA1:78369FFE698A3B97519C2F68E71AB49961957993
                                        SHA-256:CD48C6B94CA9ED82E69CE5497D66C68E48C2E40C9874D5618B5EDD940759CB21
                                        SHA-512:1BA64B0EEA23BE046EB6C475878ECD5ACC19F8A1DAE70471BE5C0C65D4E3F078B2A741676A61B5F60FE6FF432D71D2F579EA2B6C8D325F0B89B524E17A011D4D
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=gloss_wave&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=glass&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=glass&bgImgOpacityHo

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29596)
                                        Category:dropped
                                        Size (bytes):31389
                                        Entropy (8bit):5.222039123586008
                                        Encrypted:false
                                        SSDEEP:384:6NAnlcR8lOXHc11evnPzkpmX+4M6GwXKJSc7nfZBhVBWGc:SAOXHcEnPzkkDM6GwXK3BhQ
                                        MD5:33AA343026B23D274B73B0696D159167
                                        SHA1:6969B39C578EBFE70C5EDEF7572BC2468AE415D0
                                        SHA-256:A578F0FB1E1D3A84D98110663C3FE294415C7118F6739EEB65A623F40F6446B4
                                        SHA-512:7BB4728EF22EA1B60A4C56FF1B187C9322686C1648F4730361A1315E4C4597C9BDC7A13FFB3E3A9F1FF7F2A5452F7D368B9C815DC4A7D42A5C10B6FD515D6144
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=gloss_wave&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=glass&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=glass&bgImgOpacityHo

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1370)
                                        Category:dropped
                                        Size (bytes):17955
                                        Entropy (8bit):5.081854892281221
                                        Encrypted:false
                                        SSDEEP:192:XYNAHB4LCVrwF5fyJ/cEczYq05NQgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqc6G:XYNAdVsF5fy6EsDS25Vc6Kvlak
                                        MD5:D641C1A55384E6F0B0D8137916F7113E
                                        SHA1:9493284C7A649EDE21D6E806EFB0337782433047
                                        SHA-256:E5E4ACEAF8F1C37A5CB9038C98816C7E3CE03940EF873E2B4AD087AE71D23B7F
                                        SHA-512:BAC8933AB878C62592BA734ACAF88AF297B5FB99195716068C6A180F26DA73B37316B318B4F362F830EC7F8818126E4A4B70552498F374B6CF6C127EBBDB0111
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=gloss_wave&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=glass&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=inset_hard&bg

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_55_fbf9ee_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):393
                                        Entropy (8bit):6.51579365852352
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+JgR8nBtx4xzS+Em63KEMlOX:krr9+QwGzjEmdEMlOX
                                        MD5:DAAED3CF88E742A2D3820B4C8C55F3DE
                                        SHA1:00A345857359FC294C80A28E8662408C31BA602D
                                        SHA-256:20FDC83C863EBC3F9B0BF34A4B6FB7FEE55A2E03B77B6303D8D000028525B79B
                                        SHA-512:900C94334A4651E808EE6BAEA22901636D44B2B70A0992BC7D6AE733D316EEAE69F857CFAF665CC1F10B76069A25C3DBC3FB6FFE120FEAD1E8BB8893C10E998C
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...!..A.....b.l.....A.1{..V.Y0i..x...x..v......D.K_..O..9....a......}..^..Ja..0b.vBA.$.,.Q..."_44....=.Sqc..yE..I..W..<kA....i.0....<a$S..y....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_65_ffffff_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 1-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):265
                                        Entropy (8bit):5.620668247500632
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh3EUyKO0kIojl2XIzgN+Em6hp/KEMlOZp:6v/7J0U0SXIzS+Em63KEMlOX
                                        MD5:ED31481B45167E6F49FDCB1499911BF3
                                        SHA1:4C129F32CABDF52B0EAE217A30360C3571390986
                                        SHA-256:15470C38D6F3194815FFCB9CB182EE4AED0C4E0839B7B5AB0A5FC1C6ECB67C63
                                        SHA-512:7C0199CF2FFB71B0CD5348E7171AC0E2263EBBB92EC8F4C8C659EDA552FAF1B0A34B3263DE0F044360F50E86DDB3CEA23F5CE1C63AC2C514789C58399397A0F2
                                        Malicious:false
                                        Preview:.PNG........IHDR.............G#7v....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME....."....!....IDAT(.ch`...p....h...4.i...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_75_dadada_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):323
                                        Entropy (8bit):5.9920009116983115
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkMtu+UpQ7YjbIzgN+Em6hp/KEMlOZp:6v/7JSUM7bsIzS+Em63KEMlOX
                                        MD5:9B9F1106E912005670402C03BF82F170
                                        SHA1:8B7728C1588050612D7B3F58FA864620968F0C9F
                                        SHA-256:00EB8C3EA9655DA88F6AC78D327FC9AE95F56C5503BF21BC6510C14BE77955FA
                                        SHA-512:F0606E260C42AD909CDBDAFE1E86A4D2F0876980CCD4F20DC8145314021CAAF23945B38569C3FE90C835B02E9FC21BA73C6B817427B86DADB408538CD9978361
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...KIDAT8.cx....a.."*....n{11.ab.gb4a....)....&.v......11.01.01.fb\.. 3...EC...... _>o....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_75_e6e6e6_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):324
                                        Entropy (8bit):6.098454715199907
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkMkp5RqM5TC2szKMvzgN+Em6hp/KEMlOZp:6v/7JSUTpDfYyUzS+Em63KEMlOX
                                        MD5:DDD65FFF8A75A609B421B4E3237EF807
                                        SHA1:726880A9486CF2D048BFAE5EB03C02EB10610B85
                                        SHA-256:0756E317C0F7C8B82C40B80E24BB62654E36E8CEFBF2666837765C055443B232
                                        SHA-512:EA5CD6266C09D1149417DFABF10D4CF60F3C6F12B13D8EAEF7CA76C5A5DC191D407D3AD271D60F7B9E1784704E045DEAD1E5A447E471938DD2F82C573D608A2A
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...LIDAT8.cx....0.F.u..g.....ab...x...+..7&F.&FN&.oL._...3|dfbX..I..Ax..<......0.:.. ....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_95_fef1ec_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):390
                                        Entropy (8bit):6.486146272952941
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+Awk1em+2vEKvEA2zS+Em63KEMlOX:krr9+JAvEJA2zjEmdEMlOX
                                        MD5:D699723AF8436EBA22B885328314BD55
                                        SHA1:E98D44337839A92BFB993E56837CAAF0E0BD0CF6
                                        SHA-256:F3F6CE30DA7D2A7F442379FF3626F3252A67FB874A3F7304B0751AA7157EFAEF
                                        SHA-512:0647A00337946FC123B57A842267DEBCDD4CCC34346283CD4B43D2A777E308164991CBE72447F191CFAE424A44CF1AAD9DCEE6B6023214C84CA67D2C8D5149BB
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH.....a........\!V....J#X.....D}.....f.>....>...P..x...x......q....u...q...f.+..6....[..\.......W.T4r...6:.]V:...,.(....8..y.G-(d...H...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_highlight-soft_75_cccccc_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):325
                                        Entropy (8bit):6.170136138042224
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOk3S3OKjr09zgN+Em6hp/KEMlOZp:6v/7WdU3zS+Em63KEMlOX
                                        MD5:5E93533BF9087857A8369C2D27467633
                                        SHA1:AD5B492E37E840A22A369631DE394245159CC6F2
                                        SHA-256:B8F77242E550E590386C19F50E0F15F6615ACE7AE557AE5048FF56F8937A7B2B
                                        SHA-512:6263DA0A73674599C94E10D0E01898D8C6F07DBB6297F9AC20009E9D9A94202BE13B4B1737FF7A2E45F1B8603B13D57EEB5DA4E861DA28E831C932729E313D34
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...MIDAT.....@......n.jn5.$.@...(...'G...i...D..7\.....;N...p.....-.u.....&........%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_2e83ff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.770844676212274
                                        Encrypted:false
                                        SSDEEP:96:aNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:UHm231Nvu+wIqltWOe3nIP
                                        MD5:DB3B908BD060C6F278FDE9E11B3B94E3
                                        SHA1:3F4A9C46377EECDE2C1368EF2B963712B8DF5C75
                                        SHA-256:CA8FB2EB9A086B0C170EB61317C91138EC06EA0FEF878B8E24D1F50BF6AF2A17
                                        SHA-512:9D27F0E66856343254B4C75969B47B3EBACCD95E63981F18472563D95CB85AE3A1A286187F25DA0AF0996E5C783B8807BABC6C7C6698A180175B06C31A949488
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................).:w...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_454545_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.925434318681863
                                        Encrypted:false
                                        SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                        MD5:5C3BA680CC34CD9B30855C180474A152
                                        SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                        SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                        SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_888888_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7111
                                        Entropy (8bit):7.928604829942714
                                        Encrypted:false
                                        SSDEEP:192:O+057dZiVq1IWkYLeDEdEsyyL47BhYk6aNCdjh4:O+0pWVljYLREsyyoA6CdjS
                                        MD5:CF9C28612E00F36E9C312DA7689AB3B0
                                        SHA1:4D8D263100EDC2B443EF6C7118417126DC6CEEC8
                                        SHA-256:A046793EDDD1EB9087A6118ED0ED442FE8E1FA4BC4DEE13CDBA2029FBCA010AC
                                        SHA-512:B2B4DB53A81CA36E36D64CCE853F74B0814BF34C8D3807EDEDF84CE4A2EBE9613C335874F1011773F305345E58A0EA1F1DC15559A7DC5B0286A14694EF7F3942
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..I.( ....tIME.....%...'E....IDATx..{.eE}.?.H(bX.!..[R.`....J.H..!w..M.b...F...h...............XT.#.D.T.;"ba.Rqw}.......G...)b.....}N..9..sO....s..Ow.~.8......<..3.......@...@F....3.... .....$........+.\.....$...................Ook...0.Z."..."`Jy...Q.z...B.7i..Q'...........q.....I..v.C.......T...2..m..k..5e[.7............G.t....k..!HL.^?3d.J...[...f.Z...S0.Ms..}`.....T8.t....US...........@1.a...`..fe..k......6.^.../........@........px{.|.A...Q...."...i....O....=.]...}....=....\.z...\..mc.-...>....(..D..'.L.6=.......;........l.............=.....M/>....6..(.....0.......$%.GI_.km..+.$..q.....W.7.~!.....px.h8..4.^.../.........QG8.U..k....V..}..A. ..*..s.%......~...a.JYT}.-....c*v......J.=C.`+~.P.}....\....=....4...3.....%4.Ph...F,._..\....WR..>4j"m.h...i.@I...zJ..y..ts.Y...@.e.e'..C.r..jm...C.&...[..LM.%m{...e^....%..f....lN...u..d{..$.*."n.K9(...u..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_cd0a0a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739814671431308
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                        SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                        SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                        SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36536
                                        Entropy (8bit):5.275194338840845
                                        Encrypted:false
                                        SSDEEP:192:10OW0QYpynb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURH4N/z:EYpynb/+vaW1e071F5fyBErDS25ulak
                                        MD5:BF051F24690699BC2665EF6E4D7487A7
                                        SHA1:0A5599C5783E60B7D51E928812039F3F5C74666A
                                        SHA-256:F9B751C1CD0D2B0F91862DB987FED9DDA48758B15E6F42CA67796B45F4B21702
                                        SHA-512:B0E0B50B753FECBE36028D7EFA3C150A99E59616F19DF0F9DB9241644DA1D7E7189CB8376881371B544158A4ABFFD705E4BC41D42C4F72402F1EACF3ECEE1AA5
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=highlight_soft&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=glass&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=9

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29523)
                                        Category:dropped
                                        Size (bytes):31286
                                        Entropy (8bit):5.218372761012579
                                        Encrypted:false
                                        SSDEEP:384:EYpynlcR8lOXHc11evnpz5mG+4e6GYEKlSc7nfZBhVFWGc:E4yOXHcEnpzUee6GYEKDBhM
                                        MD5:3C2A865C832A1322285C55C6ED99ABB2
                                        SHA1:B456F4C43E3D45F0A85811E2C60B2256DFD2EFDB
                                        SHA-256:BE92933B839BD4CE1B67C440BD9BD832D8A7333D578C7D1061D00EDBCEB557D3
                                        SHA-512:FB45616EEF2C454960F91FCD2A04EFEDA84CFACCCF0C5D741BA2793DC1DBD6D3AB01AAAE6485222945774C7D7A9A2E9FB87E0D8EF1EA96893AA6906147A371BB
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=highlight_soft&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=glass&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=9

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1340)
                                        Category:dropped
                                        Size (bytes):17882
                                        Entropy (8bit):5.072830940698532
                                        Encrypted:false
                                        SSDEEP:192:X2YpyqN/tNwF5fy2+kXcEcINyB5NYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhdlR:X2Ypy/F5fyBErDS25ulak
                                        MD5:E4327912458100FAA111DBE7BD75F4D9
                                        SHA1:A2566EEB6FE07C3C1ED420E7847D92447457EF55
                                        SHA-256:EFA52E8C5D9D6B5E4F28174788304FEC2F279A52B999BA6B806AC852A12A5509
                                        SHA-512:A2A62110A5F170AF0225E3695A5E41CB56997C0E361931751996FB0182CAAA08C201983105978DD2D88608FD8354607351751832D8F3746FFDCD715620578734
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=highlight_soft&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=glass&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=glass&bgImgOpacityActive=65&borderColo

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_glass_55_fcf0ba_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):391
                                        Entropy (8bit):6.55690601973133
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+D0hJkHTx1xwKzS+E3V+2EMiVw9:krr9+ghWxwKzjE82EMr
                                        MD5:8BF4A2E7590E3970ACD416CD3316B9FE
                                        SHA1:DA0F754D6641364067F95A83C7B65286CD2DE909
                                        SHA-256:4D3E42B5EE27F39276D1426A819549865E285CA0018AD323CF526FFD172971E2
                                        SHA-512:0022BAAA1E32215DCAA4BC6E3E4DD511979E52EC4C6BD200DFD4B1893006D3FCD6958CD1324AA051F01E6E505CABE28CA6D2AA79D0A8A8E2FB4880E816283819
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH.....`....;E...Zv...n..V..5{.^.........6.....h...^8ph..x....q.oC.e..z..........vU.o.1#...Q..vT...."...kS;..&.u...,.).>._.v...!.p....|@j...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_gloss-wave_100_ece8da_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5817
                                        Entropy (8bit):7.684670763456218
                                        Encrypted:false
                                        SSDEEP:96:fHjNcCWhpgKcYa69MWkATL587NYTv8B+C4CS2fzwIznpHDHIawkGfUin7G:Pj1Wjg0a69ZASTv8BAwPzZHyUAy
                                        MD5:B48C85BA6D9BD33B52AF8D73E3374E8C
                                        SHA1:EE2D179E2EF219D3BA8AB8EE8501EE5B803D6552
                                        SHA-256:C230D01C2F651EA4CDC8FE31984948905B5561DA9EB8C2E0DA02A3BDAC1EEFC9
                                        SHA-512:D3F2EB8012B14CC9FBD1EC1BF3B55C9BA6B53025D775C71CE83CB05DEA3FE0835D64424DFA53A1CB704424A68E0B0EFE64900C9B5EE37318F69A1BB4BD74DDD1
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATx..K.^.U.......1.A.....A.ZG...A"f......h.....{@.......w....".!..U........4...o.P....n...R$...=..{....|.s~..ss..k.._k..{.._.r|.r.........j........q.....X.........l........6......k..w.....5..;.............`.`.........q.....X.........l........6......k..w.....5..;.............`.`.........j..v..-...Sm..K,..S.RQ..<T..7z.b^.l.%...Ds..>/....z.U2.(..gS....TN.,.ZN..V..W......WF)..g.\.W.%/.5DQ...Z.-.&.+P.g^.{.5y...l...X..J,%..<b|..<...........$xn.Y..p~..9P..5{....M92>;..O.k[.q_.2JK;G...~.Y...;.u^..K..A.Z6..7z../.<o...C.....r.m;u..)..y.[W.L.].Jf.7".j.....x|..{....L......EX..........'.U.....`.`........,.e..[q3..G.'....}.a.a..T......(....<.RZ...G.u.Tr.....2..C..>.5.N.\..WK.....}...W..K.7O.?z...n-..HYS.@.Z.+/wy.3z...Q^=x.:.z.w...c-...d.K.khA......x..,..d6/..J...u....>.6.....v.V.H..a.!..C.....e..q.).S..:....S<..F

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-hard_100_f5f3e5_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):394
                                        Entropy (8bit):6.418949384814716
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+DRCLwIBRzQ67pPJgzS+E3V+2EMiVw9:no19+QdBxQSphgzjE82EMr
                                        MD5:5AD852FBFDC1BEF56FD9FA29D82337E3
                                        SHA1:8E93097664FB53F9CCC19C5ADDFDDCBB1E81279E
                                        SHA-256:29A7A7B7A0506713D11B755F68836DA0905AB86CD0A3D65B5CA8CF81F0F72A1A
                                        SHA-512:99844BC6AAA0132DFE2299FAB33A4A679C67EA2DF94FD132194756326115C72255B302C4C90DC71ADE0DA5D96DEEB948DC2C6D63ADA5FEA12BF799E2566973AB
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.c......>&......Q.......3..[~..r..a...."..^.|..4.C;C....?.......g...w..~..^....G..o8......j+.C.............a........~Q~.......O...7.....BB..o.p...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-hard_100_fafaf4_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):379
                                        Entropy (8bit):6.402477277052991
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EWqiXm2DIHeZttpEx5wMI5zgN+E3VKF2EMiVAVTp:6v/7WogU9+mXmL+Ttqx5b6zS+E3V+2Ek
                                        MD5:F6D7F3181C5D064D2889525322F0E928
                                        SHA1:D2F282EF7C8955CE88076A3A757ED984FF1DE59F
                                        SHA-256:C448B81DEE17998BEA1596080F0558AAF5680EDD6E7405EDDC951DEFA54C5DBE
                                        SHA-512:4E84F814F417993A5EACD47465915D7A1CD073BA88FB0917B50DC5408E497220EB87F2833DCDD6013636641F66A5A5BCC926E1C98A2CF250C5DEB62BAB2EF665
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....P...?7.3P2..8..0.....k.P...5..@LX.|...8..1....ww.......l..L.&..&D".^{.?.di?a....00.`.U...<]..Z!..N......[I.9..?....;.qT|....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-hard_15_459e00_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):380
                                        Entropy (8bit):6.430777033274858
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EBsSO3WopfvcMeGGrxD2CJzgN+E3VKF2EMiVAVTp:6v/7WogU9+/O9pXcMeGGJ2CJzS+E3V+W
                                        MD5:FDE0ACA7B0C5540F60408E08EAEDA139
                                        SHA1:957FDD70495B752FA260816286AEB1F24E988178
                                        SHA-256:A48F5D8887DA20CF63C77E9E00D688EAE209E4C92D01E0D7E3257749B9E0F69C
                                        SHA-512:34B2BD05B5ED3B8A28F204481CF136327D055B2EC44693AA1987AEC248DB710857FE19583B4F16681FF621807F08A614266B86C8BF47E12E5D245B780F069305
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....P........NP&@A.$.$.L...1C..)P..].f..c.<$......zTX..?............U..fLL....TQ.=e<.;...U$..Frt,.6Om.`LCk.u..;.?..E.:.o.GQ...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-hard_95_cccccc_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):317
                                        Entropy (8bit):5.9481014168776705
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkB6+pLcXb0VDSj2zgN+E3VKF2EMiVAVTp:6v/7WdUtqXWzS+E3V+2EMiVw9
                                        MD5:A59F6D7582F1126FD096A883D295AADF
                                        SHA1:6E52C2B7763CAFDDBC13CEE0F1DA0E1B5C850145
                                        SHA-256:D7208E0189A4C99B0C7DCF585C92397DC22A12699DC9CA5FCE5C04363F761CDF
                                        SHA-512:0BAC5EF6895D9DF5E9FFCC80123AA7B325084B960C28187426066503AED7A487BFEE192B997C3F8A30AF38300818CAA63F61B36E59075C85AA19C18E79A5DF6E
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......EIDAT..cx....a..y......c.....6...L.[.n.d...p.0.e.....I0..`.o;..d`b`.....o......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-soft_25_67b021_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):411
                                        Entropy (8bit):6.622951677016995
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+G4VCOw7L090zS+E3V+2EMiVw9:no19+DoOwf090zjE82EMr
                                        MD5:916F5242DDC366581A4E27F587414435
                                        SHA1:2477511778ABB7FACA494FF07BF5F82912897124
                                        SHA-256:925DB451C705BD16B66A084ED9B3656387830131868E5E92A8660DDFD499D7F7
                                        SHA-512:03530567A01F90B3DC7E326D9EEAF97622D0A209BBCE89C5FC9EBF53C61020CC2A9DC9EA7278F8CFD1246E32B7678232AB526F10B8212B919AB532ED8645AFC5
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..!R.P....\....a.|e..@2..4.L.....#+j...RQ......0S..b......ioI...?..d.FVS2r1I..U0...j.L...d...L..Y.#.Eu..LMr,....|...[..d...L...d5.&1.j..3.Wf........._..a7.@._...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-soft_95_ffedad_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):409
                                        Entropy (8bit):6.56783434179835
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+B6lGW5jfTO/Z2zS+E3V+2EMiVw9:no19+wlG6TO/IzjE82EMr
                                        MD5:6CFD2E60683A1938A11922AA839984A1
                                        SHA1:0AA783ADF35C4A21C3980B0832D4A57AD12CE791
                                        SHA-256:7F08CA7830A2468315EAFB1E1E23625A2F9BA3CEB1FE0A17B773A9B2424036CD
                                        SHA-512:698832C8E9DD14107F73022D50EE41E8200850832C3E5E5457E3CE39C5BD8F858DE4AC4E9AA5E9A1D1CAD28AD3C2F07233E6AD0BAD1AE4F1C6318DE49EC53FB5
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..1..p.G_>..f.....q.ghz.J.@g[.Z:X....ER..............!=z.....pf.T...|..u.............C.!.v......dSC*:..).,.Hyc..h..#]....<7B.T..g!r..o9..@.....x.T.T........%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_inset-soft_15_2b2922_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):380
                                        Entropy (8bit):6.461070348423757
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EBFmBGSxK2P+YaOsfc6EWU10R9mJ2zgN+E3VKF2EMiVAVTp:6v/7WogU9+A7s2P+IMc6EWU1pJ2zS+Eb
                                        MD5:F81024672586DCD00BB1EFE5CE5609CC
                                        SHA1:3CA80356A781540FC0E9A168E7E7CE093D7B0567
                                        SHA-256:E92AB30319BF5F5D1437C3517CBEB51E3BE4AFAC9A53C304851A2DF3DB0BE253
                                        SHA-512:D0A04C41EE7ECC50AFE39417EE45E59CC6661B1B2E3BD7A2EB5CDC09DA664C0876EC18AF31EDB1A87A93BD2922085C73964256F17A0AC49361B2C425DEBC7821
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(....P....1.B.0..9..9...xb......h........$...\t.Mm8.*.F=4...h.o.3r.i%.,Fd.............d...s[.:1....1(.N....V..?v....#r4.g....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_808080_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7117
                                        Entropy (8bit):7.923945259207644
                                        Encrypted:false
                                        SSDEEP:192:Y+Ud8y7auSvSbMkhRFHMcYkFPrj+0YLE1WXE4e:Y+gb/XHMtkBjMn+
                                        MD5:FDF6299906487D9970ED37DD84E67250
                                        SHA1:49DD01B6D573B340DEA80743DC5F32BAD5CFA1A4
                                        SHA-256:C89F549E41DF136A408D650F9517186F62D5418F00955B32667A0DCBED415FBE
                                        SHA-512:4DCD2D48B6A4F14EA3CB024FFD4CB90C43B6360A2CD3723A98FEC910244048B394647068640B1F9EBD3A041A073DD2A026E20CF29093BF381E1D7C916359674E
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..G5......tIME.....%...'E....IDATx..{.eE}.?.L(bX.1..[R.`...J.H..E.M.b...F...h....P..... ....XT.#.D.T.;"ba.Rqv}.......G...)b.....}N..9..sO....s..Ow.~.8........d.1..x..^.../.2..........m...&.@..`..MX9.2....$)...=.,...0L.L...}.0~z[.....J...%..S.#.G....po....I;,.:q! `.X! 0.\..C...."&.@....#"J'..?ie......k.2n"d=...t.......&..S..6MC..r.~f....0."S..*.j..`n....,e[?.....1l..WM.......+p.....G..Uz..F..Qb..^......px.h8..4.^.../........@.....q....F.{.7...2.m..0?..:..vux.....r..n.0s....Ws.....s...G...h..A....2...t[l.{.S..O..7#..N.G..=..Z.S/..co.......7...Vk.2O.....j.llc.l.`..[...<.%}a.......x...t.7.^..p......@........px.h8..4.^.....CF...W.......E.K%.2..5..UA...(.<..`......+P..3l..X..S..G..n%p.U"..R.[..........R...q._`....P.5`..Y.BKl.5b)....Z|.......t.Q.i.E.. Lc.J..t.S...Ch....Jgn.b..(;...Z.-..tVk.n...R71.%.5`j..i..@/...uq...4s.h.`s....... ..]&.Ua.q;].A.....7

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_847e71_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.776257661253038
                                        Encrypted:false
                                        SSDEEP:96:tNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:9Hm231Nvu+wIqltWOe3nIP
                                        MD5:0F6217A6D8C5FA6182B2D3B0CE5BA27A
                                        SHA1:8E8369E95B0C69B840B823E0C10C98781A1830F9
                                        SHA-256:9E5F817E9290D81C7E075704163A57B9F3D8BF68C474F81535AFF71762F4E8F7
                                        SHA-512:2C7141DBDCBA9F63EB3AB74D505B773B84220C83C39EA652522C16BE5730F2CC537EA4F29FAC386B85E48FFCA7A04F6135B30E8B364B0B6D58CCF6E902882C08
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_8DC262_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.775872077303001
                                        Encrypted:false
                                        SSDEEP:96:JNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:RHm231Nvu+wIqltWOe3nIP
                                        MD5:AEA745F96521B224FFEFE0B09A2B51D3
                                        SHA1:FDCC8D416A78574B8046355B3F6DC59E9F0716D1
                                        SHA-256:001DAB314ABC06451A9DB2484608E8F1AF9C37597D66550FF7B04DB531D1CF65
                                        SHA-512:0195425A8CA501A9B10046C3E783515063FFC2ED73ED25B42AA5B66CC4C169D1AA7E6B26A5F0D63C3367E78F4BDB795CF4BCE6ADAB61425C970BD793DDB77144
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..0....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_cd0a0a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739814671431308
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                        SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                        SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                        SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_eeeeee_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7010
                                        Entropy (8bit):7.937028775954862
                                        Encrypted:false
                                        SSDEEP:192:alNgJh1aEbYK0aRv2Tt6sqvaZ6t939Teulhv8CVL:aotbbYK0aRvsnFZ6f39Tei88
                                        MD5:53E268DFFFD69B4C3A204488A93F331D
                                        SHA1:5CB0300B3020FC197603F8AF8F1B0674EA673D84
                                        SHA-256:0B71B6FF77D7DE81E242DF3EF02FEEDBEDD52B8642B0DC9EF5BC9E5477414BA1
                                        SHA-512:6D587F179A8F01E49CE7B258AAF60207E6B2A1154DBEAEBD68CAD2B905ED54CECACBA0D1D5B311B08CDD893F2AF6E603DE1048D797A498949BE769785469C440
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD...?.M....tIME.....%...'E...EIDATx..m...y..c.Z.....c.......BR)....6.bz.H...I.i.z.w.......P.-...z.6MR,...U.X.b;).n..XCc..8.*.......63..{..W..w.s.9...9.s.....:cE.+..[8....."..4{]...#@.M.:Q......../.s....Q....B$.....?.L..:.....Lc:w..rW...>......#...D...B.Q..>,.*y..c.....\....^<..]bt...C.y....J..2..M..+..d.5.#$=.......4....u*.R....A..3}...L.....I...w.%..M}..}`R...YV(N.=..7M......AQ.......X.h27H.5....p3.5.#@...Ps8.....5.#@...Ps8..l.^...Q....#.d.ij...g0...?.....}.HR......oB...)..mR.............P.G.t.6.....@W;............ ..b....1.6.....nj..Fo."gZ.(c...\...@G.S..].3.k......../1.9..p.A5.#@...Ps8.....5.#@...Ps..........W.+-\..e.J#.......MA.=.rq..Ak......E.s......b&G..vW`..@..B...{.....Y4..%..c.M.<.L.,v.Hbn.......r..&....l/_.cn$......D.F.*5...T.>..,.......N.N...k.A.@...1..ag.{.N..E.:..[..t..M..6....&].M*.L...../....u.;.tv...0S.,.jP....:.=.z..L...i

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36786
                                        Entropy (8bit):5.282160205211848
                                        Encrypted:false
                                        SSDEEP:192:10OW0sRdX0Zb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHC76:ydeb/+vaW1e07PddF5fyfEvDS25/
                                        MD5:5F3CE6A81EE8FE565088287F643091F8
                                        SHA1:FC9505428703E02CDEDCADA79F4812EB27E1F257
                                        SHA-256:8C736B0D1F47B29FA98FC10CC4F2F07543441E9F23E987B1484C7146635AB17F
                                        SHA-512:73576139BB8D465F1D25676ACF9843DAF4E07C82F0C96A185F57638D22BA8ADFC8DA2F0C6BA4625C4C160A2FE93CA9D3F2B598A5F8B37D00011B64680B89F291
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ece8da&bgTextureHeader=gloss_wave&bgImgOpacityHeader=100&borderColorHeader=d4ccb0&fcHeader=433f38&iconColorHeader=847e71&bgColorContent=f5f3e5&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dfd9c3&fcContent=312e25&iconColorContent=808080&bgColorDefault=459e00&bgTextureDefault=highlight_hard&bgImgOpacityDefault=15&borderColorDefault=327E04&fcDefault=ffffff&iconColorDefault=eeeeee&bgColorHover=67b021&bgTextureHover=highlight_soft&bgImgOpacity

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29738)
                                        Category:dropped
                                        Size (bytes):31569
                                        Entropy (8bit):5.226827075703083
                                        Encrypted:false
                                        SSDEEP:384:ydelcR8lOXHc11evx0zkmc+4i6GpaD/Sc7nfZBhVE:2XHcEx0z14i6GpaDRBhW
                                        MD5:214251BCC995B04AB7591B5A91F3D613
                                        SHA1:CF0BDD7C7A728BA85F0D09B3CBB32E63DDDEBA24
                                        SHA-256:FFCC4681C57A329F5F15ADAEDA52D839660D96E09DAC712F05F8B0869903FC9B
                                        SHA-512:EA793B66A6F7170DC52325FAD5A2834A7AECD2BFCC69F98F053666536A4AC2413AE9945EB758B96C4F6C7B88FE3E73CE85A836ED3EAD407C54A7BA21F91785BF
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ece8da&bgTextureHeader=gloss_wave&bgImgOpacityHeader=100&borderColorHeader=d4ccb0&fcHeader=433f38&iconColorHeader=847e71&bgColorContent=f5f3e5&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dfd9c3&fcContent=312e25&iconColorContent=808080&bgColorDefault=459e00&bgTextureDefault=highlight_hard&bgImgOpacityDefault=15&borderColorDefault=327E04&fcDefault=ffffff&iconColorDefault=eeeeee&bgColorHover=67b021&bgTextureHover=highlight_soft&bgImgOpacity

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1408)
                                        Category:dropped
                                        Size (bytes):18132
                                        Entropy (8bit):5.089714022844099
                                        Encrypted:false
                                        SSDEEP:192:XmRdX0i77gndVjE5YF5fy2RCcNeeqEcY9pn0NygmB0iBfT9RhS2wV53skuMaaSQm:XEdAddF5fyfEvDS25/
                                        MD5:7E69CD2743CA2896690D9FBB1E119318
                                        SHA1:CBA6CA6BA67596D14070FD4EBAD98F2B3DCEC4A5
                                        SHA-256:319040E0E34436F99396573380A1BC08955AFFED065F37A49FAFC9E72F240CF0
                                        SHA-512:9A2F7535D8B664D9A3B5FDDAEA9965503B43648544C498A17AECD5D1103149F6FFD06CEB51BC5E649C002CD2890D43AA4F51FE6D5B744313F3E958A329D8D0C6
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ece8da&bgTextureHeader=gloss_wave&bgImgOpacityHeader=100&borderColorHeader=d4ccb0&fcHeader=433f38&iconColorHeader=847e71&bgColorContent=f5f3e5&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dfd9c3&fcContent=312e25&iconColorContent=808080&bgColorDefault=459e00&bgTextureDefault=highlight_hard&bgImgOpacityDefault=15&borderColorDefault=327E04&fcDefault=ffffff&iconColorDefault=eeeeee&bgColorHover=67b021&bgTextureHover=highlight_soft&bgImgOpacityHover=25&borderColorHover=327E04&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=fafaf4&bgTextureActive=highlight_h

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_glass_45_0078ae_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):403
                                        Entropy (8bit):6.549410477715596
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+YLvWMP4m/a1sPzS+Em63KEMlOX:krr9+YLvWL31sPzjEmdEMlOX
                                        MD5:05B4189C61CAD5711E124518CB55D11E
                                        SHA1:B4CA6A3F981478FBEA4D1E40EB8F0F5BA5B2FA5F
                                        SHA-256:59CEBFCF759B6B7ED33FD4CE165223F8895C090CD2D943F11D6F582E50FEF05C
                                        SHA-512:0D820891E083DE8A41C3D0CF5797D6D3015613F43C1F401AE53C7B69F47D99B1FE019213A275469760E18029B4E2DACF4AECA7B4E34D5EA55A8D503CE3AE66A5
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH.c...pwo .......(5J.R..(Es....?.21.g..8..E.I...+.....L.?..1Mab{.,.t...>...]&.`.H&&&.`.H&f..]..=&.....;.X.0/d..."......1....c1.......(5J.R...Q...#........%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_glass_55_f8da4e_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):403
                                        Entropy (8bit):6.460562824701208
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+Y0gs2gttFr59GnHPvlKiavzS+Em63KEMlOX:krr9+Y0gs2Kh96havzjEmdEMlOX
                                        MD5:67E15B90051B76936D9FE904E4B1B972
                                        SHA1:D66C7D1C33D1CB0DAA6B3D0F79592D63818BCD24
                                        SHA-256:4E393510798CBCC6746684F6C0092651FB59AB9922C475D91F4C50C92A932893
                                        SHA-512:563E145B572369C7B18774379A95DD745DE4FB3D27B0FD12470C558F930FD0BE2718ECF907215F255A91F115A0D86F1FDBE672FF3CE7CB628CCBAB68A16A70AA
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...1..`....}....,.&..J$mR.!q....T'.K....I.1aq.B.q.a..g~.Z_.b!....0...^>.....S.R...\...w....B..WB...b..O..Q0.R6}%$.]-.x..1........\i,8.0...a........%......%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_glass_75_79c9ec_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):406
                                        Entropy (8bit):6.591491659482794
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+ydFO8FSF2FrzS+Em63KEMlOX:krr9+ikyzjEmdEMlOX
                                        MD5:91B2A996DF0F598E2C3256D1BBBAEFC1
                                        SHA1:9CA8B4C79EE52D4CA3F3158068DCB861B0F9AE68
                                        SHA-256:20DB51643CC06CF91D7E2D76504D0669D3A793FB9B90C1CCF248C72E8B0F1AED
                                        SHA-512:518C362686DAE2743C79E44F37C6D3B565B21B533FB48FB29F4634A7EC986203149387DEE6B390000092C74F84BE7121A7456208ADAC78BC1F3E2854BDEC5573
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH.....`...s...Ddf..^...;0,Y.^.qE.`..,.l...u...A....5../=.........a...u.....I+n.Sm......\(HT"S.+b!.Q..\..+......O... w..;..Jf..oM.&...St...i.0..../."...+...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_gloss-wave_45_e14f1c_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5922
                                        Entropy (8bit):7.68968045947838
                                        Encrypted:false
                                        SSDEEP:96:fH3oGRMuCB+5wSTTJCCK1iycpnINYXYOT5TgudhYYz+7qazYaLhIAKg:P3oaMuUST759/T5TgqhYW01zpO5g
                                        MD5:1B850EED5228F446BDCA7FFCDA647EE8
                                        SHA1:8FB9F3FC3BF58564F5C752972C6F53846F281FE9
                                        SHA-256:66CBB2F82EE5CF5C1386AE154D925F3B4481CA52671E98CB15CF050F8129BD84
                                        SHA-512:9272E8C34CE6BEC23062FA5CAB0F4A59E0A34E62918FFF2210CE9FE564C92CB6BDA0C8D4AFF7D4F2C2384974DFA1C4E09E8EBD19F9BF9809E111B585E8756748
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...&IDATx.._.e.]..>..>.{I.e 05j.1c..A.!.j..&.. %.i...Z...,.4..P1!...i@..m.......6..4>t......Z...=w..ot.Y.~......3.|.............W.....{/<........XaF.v......n..w.....5..;.............`..........pp.....X.8........................k..w.....5..;.............`..........pp.....X.8........................k......&7i..S}..K,..)....>)...yj....W..BI...-.\....;..5=..x..*.)1..T*-o5......SW....U,xc.b.+..k..d-......(..[{C_-.'.+P.g^.{.5y...l...X..J,%....<c...?..=........B.<*3m....?W......,W..oJK|u..\...c..(=..-&....[5^..s-..k.a..U......^..K4.....G.j....N...-%+4...U=Syw......{-.y...7o....~...d.........Y.[........o......X.8.........0.{.$l..f...=...........I..(?.y..*..=......#.].ev....>.5.N.....[...V..YV.+k.....j.=..]..nJU..){.R-...........F.W..N....=.......d.K...~.J.Wyy.F..Yr.+.l^.)%.\D..k.......lv..]S;k..K.....~.>..}.....e..8...ym..ymR.)..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_gloss-wave_50_6eac2c_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5964
                                        Entropy (8bit):7.6902055019466475
                                        Encrypted:false
                                        SSDEEP:96:fHORrlGaNFuGTEqceljT7JUI65e/MFuN7i7OlGRufe/95ZCsCfXyRT8x:PCrMaN4GgqceZT9uM0RGGRuW/953VO
                                        MD5:879551094DE8697DF488B81F917ABD54
                                        SHA1:AF147D410236C3C09F1312782916480FC6A5EB57
                                        SHA-256:D893CA2B0E379858C35368EB8892CABA6BF504F038491847CC7EBE0D97C90717
                                        SHA-512:A55A54E59615BAADF46EDAB3ECFF3BC4E22A2703A2F266378329F47244CEB7636E100FEB5BA6B18C10EE1DD3AECDB700AEEFE852A8B8C15CAB1E99B0B0F16FC5
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...PIDATx..O.e.U..^?.....o. f..m.%@D$...-.,..QBPb.....i$.@....6,.O..#$.$H....~.D.8d..b..xf... YHl.b..eq...TW..T....-.N.S....5..../^...=........3Y.......p<.......V........+..w........;.............`..........pp.....X.8...............V........+..w........;.............`..........pp.....X.8............n.m......g/..n.Y.E...y...S#o.<.:.-.d....Q..H.e..g....YE1%F=.J..r.V..r......k,}.}e.r..z...}.Q.b.C...Xk..%..r.J..p.&..Q..<V...K..c.#../....~...P.....`.,...7......@]Ob..,W..oJKxu.y.&.i..Ve.......r..........ZuXbm........K.~..y{x]....X.....S7.zK....}U.T..duX#J....<.Z....^..O}..L........f.v..e.......)x...............`......l..;.7.]i.C..Q.];.>..4.Y....<.bZ..L..+..HG.G.].!.m..nM....+%.Vb....w.....I....S5..G.[K7.*b.=P......]^....Z#...^......}....0Y..w...b.U^^..Y{...J2..cLI%..(..z....fn..i.mG[b............l..F..<6oZ....%.....k

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_gloss-wave_75_2191c0_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):6035
                                        Entropy (8bit):7.688210298202852
                                        Encrypted:false
                                        SSDEEP:96:fHN3nrvlGl8UwCW1o/D4PgnYpjkNaSdq9nyuWrJWHcpfO4nWFR4Aq0p8Y40tZYkW:P1vMrw5MvImawqFQJW8dC+Aq0piV6v+
                                        MD5:7DB7584F3F7ED73A0588F5B7A4FF3254
                                        SHA1:0EF2E09C002050070F365E43E0C51032D9032337
                                        SHA-256:B75E9EAE369B4E83401F6FF941BBD69C7D89C65243AFF1F66F5BBC816E84EE5E
                                        SHA-512:6BC3F617041C9670C979596C5A0E8C68B0FD896B1635A780C3596B9648E434D216D44B10ABD9B80DDD26E9D349D2A46113CE7DBE4E98066006393601896CE28C
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx..O.d.u...k.d"#..D."b..e.78...'..$.".,z&..e1..%...l%.a.)...Q$3D1..=i.8.c..%...7^.A..i.H0,.lx....>;w.W5.SU..6|....V.:.wN.-x.o7_?....U.......f.l........pp.....X.8...............V........+..w........;.............`..........pp.....X.8...............V........+..w........;.............`..........\...n.m.[..X...%...1....>1...yj....U.....[.[..2J_.....Z.U2.(..gS....TN.*.Z.].V.>V.`......R..U....6J^.{...._.N...j.=.\..=.*.z...G..o=.....R..X..36_...'..B^........,....[n{.C..'1k.Y....7.%.:../&.i..Ve....-&....[5V..s-..k.a..!.S.f^..f/Y.%....uu..b5\...N...-%+4...U=Syw...a.(}7.Z...j9ho.v.......d......................2.....+..w......`.z......^..............I...EoQ>.y..*.gzv]g]I%Gz...(.+>....)u..`...J,.....b_Y#.Q..y.....h.uk.TE...*.R^]y...o]..XkDy.`....].....q.\L......SPl...5:k..\If.b.)..b.Q...//.._.Y3q...~.....C...t.w-.3.m.,[-.Q.<...!=o

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_inset-hard_100_fcfdfd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):350
                                        Entropy (8bit):6.206000010177241
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5Em3MFQ3fK3B6tTLpM52zgN+Em6hp/KEMlOZp:6v/7WogU9+C0MtTLJzS+Em63KEMlOX
                                        MD5:63B926C3D199D7774678EC2F1CFEB44A
                                        SHA1:60483976063220F6BFC4508287E98522312EE277
                                        SHA-256:0AE17677A06192D5114347DE45ED6C6F2C3A660C1202AA6EA44E12BFCE7AFE5D
                                        SHA-512:7BE4D05ACD6519F4892F63C0D8F31E4AA6DC3DAA0467B9F93F2B3C3653A87C1CFCEFD267BA03A137EB110C7197F526ED8A03C227ACEB06D2F63787708F103AEE
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...bIDAT(...1..0....`.JE... (z....BHm.......u....~..5w}."....^,..bcb.$..A"..H...V.A,npC...xQ!T..ry.D...H{*1...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_0078ae_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739187429694133
                                        Encrypted:false
                                        SSDEEP:96:pNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:xHm231Nvu+wIqltWOe3nIP
                                        MD5:C2A2DFF552EE2D63B9B12861425DA8E4
                                        SHA1:A50A98BE703E23E4D1FF74752984DB7064E87E49
                                        SHA-256:98A221399F8D3673872C94EF3178D43597713A821C92F5EBF5135CADE0F70B84
                                        SHA-512:67FB2556D393527FE8AA482A67DF36470B081904EFF37BFE2783AE6D1A8433B01AC20AAA55821B5405E480F1F162DFC6B145B1C1A7FA51E0D7BC7E355B1DE387
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x...R0...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_056b93_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.778670676983036
                                        Encrypted:false
                                        SSDEEP:96:zNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:DHm231Nvu+wIqltWOe3nIP
                                        MD5:CB52FFFA4237276F016F7180CA1C1B8A
                                        SHA1:F930726B7A6A37A4956E4F732B6FE3869646D705
                                        SHA-256:68351A21A09C652481AFAC4962544010A86F5BF4314C5F90723BE35110EF9424
                                        SHA-512:CEF74AF1812ECA1C2FB551E204D8E81122DBC638E9799D54CB3AD642C4CE3483AABCC652175E245FA1BF3A07CFD0EF0FE577D3E2B0A5D86DA7E606F652363C58
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_d8e7f3_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773667817462664
                                        Encrypted:false
                                        SSDEEP:96:3NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:vHm231Nvu+wIqltWOe3nIP
                                        MD5:06F311C437236B376B247382BF815C71
                                        SHA1:110DB3851E725E1CD30D73D292201A6699344E4F
                                        SHA-256:061647E5266E0E229DEAC8AAA16D839EE64DA5C0E7B972948DAC3D071D27F547
                                        SHA-512:C90F60977BCEBDA00CE1D77748A3E2C4F53D9526B867537143D3137E4134858F2C02D45F5521699EE0EAFF6AE4D54C4217714D75E902D89D45EB8826ED51D7A0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................e....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_e0fdff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.755367374553932
                                        Encrypted:false
                                        SSDEEP:96:uNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:gHm231Nvu+wIqltWOe3nIP
                                        MD5:91403D8B6F91E344BB6E344D26CD51B1
                                        SHA1:2280A7E734CF7A259F1BA9201D27AF6A4C4E9F16
                                        SHA-256:98B45E794E837E483E570BBEE898F2049D4C1DDDBFDA479A9C9F613D3840E24D
                                        SHA-512:7F4E5C3D06FEBA1BCE4272FB915A6DA14BE80EC9A7D72C69B1CFC92E6A73F0A0B22CBABA9CAA038EF194B090DE2711435BD8DE78318B4972CFB3325D62C5F754
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................q......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_f5e175_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.768313863902363
                                        Encrypted:false
                                        SSDEEP:96:RNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:5Hm231Nvu+wIqltWOe3nIP
                                        MD5:4541A85EDE9D67D454B0D0039EF8728E
                                        SHA1:7B51B7204AEAB4AE63FF354EDAE3BB2F8AC107DA
                                        SHA-256:38876FA7B854610BA82FC9D6C03941E79C5C28ADC7BCEA89B99BD2E0F26C3234
                                        SHA-512:9EEECAD2896A1A68D2C95ACF9D88A44ACE50BBEB1F26F64C1171DBA95B67528F81E7D890DC6C35B0C8F703282B8E1122F7D189EE1C7990B24434BDB426FA37E9
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..um......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_f7a50d_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.77507517756097
                                        Encrypted:false
                                        SSDEEP:96:wNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:CHm231Nvu+wIqltWOe3nIP
                                        MD5:64EC6FBEDFFE32AFBB48E5AA85BF086E
                                        SHA1:38844861F9CC3A3CD0C9780CDB75430BA7BCB6B1
                                        SHA-256:5C33DD220D270E399752CB32BAFEDBCC89AF5019A6D921436796AED89057BDD7
                                        SHA-512:C8A092A76E64FE2AAC4560DFF007F036C20C11DBCED03372BE80207BE9F7DC3A08297F72AE2E51CAC99B66DA5C22BCB71E64C9CBB051F92B3EE82E1FF0F8C968
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................n......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_fcd113_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773382235778011
                                        Encrypted:false
                                        SSDEEP:96:tNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:9Hm231Nvu+wIqltWOe3nIP
                                        MD5:BBA8336D01DF6BBDB30678452364950F
                                        SHA1:2031FFC7B941B7F7AD9CA0179FD4506174D0F57A
                                        SHA-256:167523F77EEAD492792DFBF71392EF5C0D3D09BC564F7087B756C7CB2A10ADC9
                                        SHA-512:19D4F385CB920D227547BC6850C33A54078EC7A82858644D762CC88C4A58B2B940C53089C73F423D186690DBEC2E2CD4CEE07B43AB06E10150FA5F6EBD373C76
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................P\;....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36629
                                        Entropy (8bit):5.281302252210388
                                        Encrypted:false
                                        SSDEEP:192:10OW0gu02b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHlnA0G:cJ2b/+vaW1e07pF5fycE2xDS25Vc6Kv/
                                        MD5:27CF8B6EDE40F8C30CC8280B7ACE0782
                                        SHA1:82E878D033753893ABBDBB9DB871DD2E2A0A61F2
                                        SHA-256:187EB517154BBD2784CEE91F411F0E7147C894240B9667A7B4540C2E8E2D9231
                                        SHA-512:03574345B653979597C0E96407350FB5B97DBA996B56A44C21366551476761EBD9AB52A25396A724E04C320FC50F28459050B2F2708E3640468CED7BC7884958
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=2191c0&bgTextureHeader=gloss_wave&bgImgOpacityHeader=75&borderColorHeader=4297d7&fcHeader=eaf5f7&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=0078ae&bgColorDefault=0078ae&bgTextureDefault=glass&bgImgOpacityDefault=45&borderColorDefault=77d5f7&fcDefault=ffffff&iconColorDefault=e0fdff&bgColorHover=79c9ec&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHove

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29611)
                                        Category:dropped
                                        Size (bytes):31387
                                        Entropy (8bit):5.224818221402447
                                        Encrypted:false
                                        SSDEEP:384:cJ2lcR8lOXHc11evj9zRmaG+4Q6G8sjy0Sc7nfZBhVBE:MBXHcEj9zMaeQ6G8sjpBhA
                                        MD5:7FE6AB79E159819A4DB99D24B79D7EA5
                                        SHA1:611FE487009CD7FD815854F29F49197E81F9EAE6
                                        SHA-256:F80A56801FEB59155E1917A23B35155E43D7233CE28087565AC1D04A799A744E
                                        SHA-512:2831924AD6BB21A61FC1B72F5836111791E978368539AC78B3F67CB20408C380A823A7C10284E8D3B47804E7C68A516340F3DC997965EAC960F1BAC55261827D
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=2191c0&bgTextureHeader=gloss_wave&bgImgOpacityHeader=75&borderColorHeader=4297d7&fcHeader=eaf5f7&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=0078ae&bgColorDefault=0078ae&bgTextureDefault=glass&bgImgOpacityDefault=45&borderColorDefault=77d5f7&fcDefault=ffffff&iconColorDefault=e0fdff&bgColorHover=79c9ec&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHove

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1353)
                                        Category:dropped
                                        Size (bytes):17975
                                        Entropy (8bit):5.088177344743783
                                        Encrypted:false
                                        SSDEEP:192:X6u0OnA0vTF5fyh+MuEcrYu5wK/lgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqc6C:X6J4F5fycE2xDS25Vc6Kv/
                                        MD5:8BA00131EEF33D92C25C87E22E083D54
                                        SHA1:64AD37E5B12A6EB6A4C08873DE00ED3929621041
                                        SHA-256:58EF3F583F08153750829DC6962A083C933DAD72FD1FC62D8A837FCEBD7A445E
                                        SHA-512:04F83B486E52B4D2A10DE05F5D5C788CB8B798A536A39F043B73E9FD95143FC6D7B5BA8D63DC41E1E211EA1D17CB77EF00C81EB573D98B11473D61988A2C0E6B
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=2191c0&bgTextureHeader=gloss_wave&bgImgOpacityHeader=75&borderColorHeader=4297d7&fcHeader=eaf5f7&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=0078ae&bgColorDefault=0078ae&bgTextureDefault=glass&bgImgOpacityDefault=45&borderColorDefault=77d5f7&fcDefault=ffffff&iconColorDefault=e0fdff&bgColorHover=79c9ec&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=448dae&fcHover=026890&iconColorHover=056b93&bgColorActive=6eac2c&bgTextureActive=gloss_wave&bgImgOpacityActive=50&bo

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_diagonals-medium_20_d34d17_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):440
                                        Entropy (8bit):6.645254076771535
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+iX1+CeVOOinRVMK7bweuRzZ2zS+Em63KEMlOX:X9+esCeVhYjbwegzZ2zjEmdEMlOX
                                        MD5:8CB63B9E938439068BAD2D541649EBC2
                                        SHA1:2832B94E06C2B4F755BEA3925198CE3C04587C14
                                        SHA-256:B44DB4293067191805F55154111AEDB6568AFE4D3B98C491500353BC90D7F83B
                                        SHA-512:45DEA1136F5F8280126773543A14CCF5EF20033A9AB17CA2C7C6F0020D256CD7F4F716A206780B01EF9C154E693588F53D2EA8170B9160D1AA3E2707FE80C15B
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATh....@......J.Jp.F.n...P..K-818v..l.[...a.l....OK.......v..k......:*9|.Q..J....k..o.&.uTr.....G..<..Q.x:.N..0.nt.I].....a.u...>..O.}.5....k<..Q.x:..t.G].....a.u...>.....%..1;b....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_gloss-wave_45_817865_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5939
                                        Entropy (8bit):7.703846412692604
                                        Encrypted:false
                                        SSDEEP:96:fH63ESQseVGhA91gbMzgDtdz0RLPgSAmP0FtHx3IV5P3qGoDOEJ3yitdPKs:PMGGhgcrKLPZgtRYVJ6Go6E0itdPV
                                        MD5:4234E7CD58DE5D96A698A6EDCDE2A445
                                        SHA1:3E382B5328B7E2FE57D0970EC85215C36A3CEF7F
                                        SHA-256:CF05534B9CFE492367271847D6BB9BFA8C4100409FB0E680EBE3B5FED82C06A3
                                        SHA-512:1BA199160873B686F1D4EF50F1C9296591D9FA747F58A0FFDABE49B6730358352556F2402D01F4EC8443FAC297C12F048AB972F0F7076F9F7B34D041DE2917B3
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...7IDATx..O.e.u..^.MD.)J28.L.c..V....).& Y.,C."d.-cGa.3H1..Ht..h@...8.!......(.i{.b%.Xe..IH...d...{..=.m.......}.}.xS...9.S...{.w>....p].......3[.......p<................k..w.....5..;.............`..........pp.....X.8........................k..w.....5..;.............`..........pp.....X.8............a..xL.^..c.^b..OYHE=...P...F^.y.yu.-.d....V.....Z.3.W......Me...r.f..r.w..m...X..J/.Zy.,...j....(.{.........7.{M.}="..<V...K...#...s.[.~.rf............v?.u.]...glkv/.U..R2.:../'...^e..v....r........9.k...kS......^2.K4.[...F..p.......KJfh..z..v.........<.Z...W....._+........c..a".A.......<U.....`.............p......x...|HW.._.o'Ugh.&.^.|..*.UJO.w]g]I%G:.>J..)o....q...d..X.o...e.2G.Vz.y.....]uk...5e.TFK....]^}....F.7..k......ul..q9Y..w...R.U^^..yk...J2..cJI%..V......}..a3l......S%.{.......-.=.6S....Q.<O.k.`.k..N.V.].;.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_gloss-wave_60_fece2f_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5908
                                        Entropy (8bit):7.679038274873359
                                        Encrypted:false
                                        SSDEEP:96:fHC5G5GhcMdQkz/dUbvU7FS6fzEsCWIz+tpuYkEpCMqsqZ/xDIeG:PLqZZ1UbvUNrEOIzipuYQMqsqp7G
                                        MD5:B694AF5933744F277DD773B99D56D983
                                        SHA1:95B543C087CBFEA02824F1DE7EF0A6447EC4B02E
                                        SHA-256:1815DC24733A0B93B2B07882C2EE13CE20FF1AF7826CD8B2CE514B18D2DEE289
                                        SHA-512:8FC7200B582F9395F3392F251910CAF52FE473CECFC543B315F0C8EC09EBD6BFADEE4E65C0B3CA0F9744D98F199FA9006833A014BE155BA318420E8F1A5B7BB2
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx...m.U.kw...m,.-.!..J@...".E0b...Jp.#.?...dY2..n#..B.".]OA !.!....%v...l..'..H(r"..v1......UU.<..o`.kW.Z..u.9{.!....|.,.........n.......j8......l.................[..w.....-..;.............`..........pp.......8......l.................[..w.....-..;.............`..........pp........>....W...V.....~.e....cy..S...:.:..Z...o..J+}^.qE...dVQL.Q.2..fS;u. j....z[.B4.9..K.VQ=[...v.V}.....9.......F..;.(........G.EU%...'ZG.q..._...P.....`.D~*..I:...M..'.5......M)).nB.W.k_..mT.........|.&.a..U..^...&...f]..zo..-...}u.[..1..o.o~....Z.|....evD#.w.:O....!..{....A&.......EJ.8o.'......`.Se..............[......../\.~&?......v|.^....:.,.,=..u.u%.....(.+>X....q....e..X.o..e.2G.Vz.u.Z.y....tSF.eMY....>..rWW?:.....Ct......3...?.&.Q.N\S.S..^..%.].f.Y.%.u1ZJ*.Xrs....K...t0\.[.8.0K..9w...i....G.e9j............./.N.W.].?..V.JJ,..V

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_gloss-wave_70_ffdd57_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5601
                                        Entropy (8bit):7.678761754017709
                                        Encrypted:false
                                        SSDEEP:96:fHShn55j57kHjG/x0dirogumOBa28bPs/5+HzRCnvf/+gbWof1ohKv0d:PS/H4C2EULBesh+0vnt1dowG
                                        MD5:2870BD72CE344FA1230B5290271568CE
                                        SHA1:356C051587C717C55F0752EB04C116C886EAE6D4
                                        SHA-256:F50F4BF5792D6EB30A71F9FFCC309CEC9B3B3631E07B5CBACA041744D19E274A
                                        SHA-512:0BF4113C3DC4C8AB4C88258544B7A22D9042E209F8AC518689EF705ACF9366786327B402C7A8FCF19BD17BD09B7D32496FDD5D82D04462FE556FDC6532876AE9
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx..M.&.u...|..d!.L.&...L.x..1.E@B".d.@l)..H6......Bf@.0.!..v6.....$.!9....3....3.;..-C..T.=?.[..}O....G..]uW.:.....z.....w.........};......g.......`.0p..............6..w.............`.0p..............6..w.............`.0p..............6..w.............`.0p..............6..w......p...(_9.~....=b.>^.P..LS.P..F[.m.yu.-DJ.[.....va....7^.d.....TjZ[k......kg.5_.V...e.......g.-.mG..o....b...{b\..[..m..E......(>GTUb..?.4b.C.....l.........7U.(]~.....I...~.....)...)k[..Z.2JJ...)....Z.WCo^K..^.0bm.....V.m.G.~D.>...m}T.......-_.H...1_...T..*.:...ws..6O..O..r..O_...2......L..>........v...............6....~...8W.&?..^5M9.SKS....Q.n.UMO;w]g]I..tt}....j....z...%R."..kA..S.JY.....*=.6Uk....u{...5.....v..][zo....F.V..}.~.k.{z..9........}.T......7ed,.)..kJ*eq...?..[)..a.(_6......P).I...=G.f..B.E..Z...v.6....{....B.JQI.EQ...R..J

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_gloss-wave_90_fff9e5_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5447
                                        Entropy (8bit):7.6937201144293565
                                        Encrypted:false
                                        SSDEEP:96:fHnk+vTQEKQfBNA2Wlv++M0T2H2NqH4+tJcHYWfUSG9jWmHpY9LOu+La0jQu5tB:Pnjv3DA2+mHWs42jWfw9VEqtLa0jD5tB
                                        MD5:921941A5B2B71FD18A9CA66102B79113
                                        SHA1:C079ECFF626806411093802AEA83D74B4E7D8FFD
                                        SHA-256:39BE850DB2EAF01CC65CC9E3D1CDB664211CD0B34AFFF7A563008EB9B284C500
                                        SHA-512:AA1236FCDB32CC5E7AC6B18E5F9FBFAC6C565BAA4711C91D44BCED650C700434A595F3A97F3BCEEEADC5D85EEF0BBB4FA4D6C1FA7F81E6726B16268572E3C23A
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...KIDATx....%G...j.3.7...........A].F..Q.U KW..EV..\..\(...q#(.R..0 ..(.B......"x.r...[S.}.z..tO..E...z.....N.)...7......l.{........q..............p..............p..............p..............p..............p..............p..............p..............\}.~.N.\./..c..).^^+...r.Z.J.m.h..-c.<.%Dz....+[.....oiz.z....1..zo*#.mo.k...%.>..|}[..o[F..J-.\y.......]..U.1..V...F.....z.o..Q2....[m.}..#YU..9.x..k.r>...mn*...............o$...Z...ol...-..:}mg....eM....x....o..u.9.{..Hi[.O.2........y.1.o..Q.1.....o..K"{h.q.U....V....".l.-.-.o..O9....uI.....ANRJg.......`.2.....p.......Izg......j...5.[-.\.S[.,.V.E_...-.Z.j..k..gR.#....v%.Z.e~..q.....o....A..Km.....#.Vz.mY....{..7eT.JS...,..]m}..w......m<x.u......=..8?...^mW\K.UP.x../..y.\.Ez....L*}./....'SJ...K.Y.%.9....../K.k....-.lE-.Z.v..zm..)..ZG...J..,)mQ2Y.W..m..d...";.Z9J.){..1..%?#J...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_highlight-soft_100_feeebd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):401
                                        Entropy (8bit):6.547463981344383
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+4hdiSjdOBdKfzS+Em63KEMlOX:no19+Ei5+fzjEmdEMlOX
                                        MD5:7385E960B273254918C00B999D211F03
                                        SHA1:5ADE46E5B00248C7E0BF6392E90AEEB192308D36
                                        SHA-256:CC61DC20EBADB222C6D6AA6395448F53442159CC122CAEB14863426DBBE493AF
                                        SHA-512:07DD8A4FF7A1FC7B7BE4D79756D1C180D55EDD2E4163C66E964462AF6AB1757B4B156C3E383688F68D49C1B70EAC1A82A469BD52140143B9F43C0BFCD3D3486C
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDAT(..1..P...w.O`..'.....o GPJ.L.........W....d..-.m..2......cP.Kc`.*.4z.>1.k..N.b..........F.t..6t..~....i39..^....B....x...4..._.q<...\.......%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_inset-soft_30_ffffff_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 1-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):261
                                        Entropy (8bit):5.51952304670403
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPQUyKO0kMhgyOTd2zgN+Em6hp/KEMlOZp:6v/7oU0g+YzS+Em63KEMlOX
                                        MD5:A02AF3EBADC6530042FD793EF06FCC45
                                        SHA1:7EED4D830D533DF011FFDCA7D421724E2DE6DEE7
                                        SHA-256:773332AA0C96DCE46525C2D1A445C2F9031735ED8FC46D149C754984CB7C337D
                                        SHA-512:B77F6A70CB772C852E802113BF63F034A656DC70E5A7843E005419935360C73B05F003C2A90060FB665F48D1098EA09C04FF3BEA6ECA8B668D6CD34FA0E6E0B3
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....oWg.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME....."....!....IDAT..ch`......2.j<z....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_3d3d3d_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7074
                                        Entropy (8bit):7.919346283987806
                                        Encrypted:false
                                        SSDEEP:96:0b5ACzsCSZcc1XFvamelC3AHKBQtP+yuu1GCntG1pJiwIqRWiqc9ed9G+k2Io:Q4CQlnH2ldGCpoRzqcAez29
                                        MD5:18BD9AE0A3BCC97841BF36D515B90AC4
                                        SHA1:D54C01803D23762E08554CC6075518B2CAABF4D7
                                        SHA-256:098A92099477A79D3EDFBF2F0875D2485704690BF2A34FD14000EE00AFAE01D3
                                        SHA-512:6A3FFD1B00304C37B5756FAE282113E204638AC687A021D52FB602B15B8E5586AC7AA74B8F0CE03F85167FAB78B0B02D3CCBA01720FDA280E61AAE0FAFC9B706
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.=..o#....tIME.....%...'E....IDATx..{.eE}.?.H(cX.!..[R.`.Tv.*.J."wL.&j...XA.d.h....Hf..Yq.h...v)0.U...Q.U.P..@.].!&.........".........s..;s.;u.{~.}............&.Ag.c....px...&.=.L.'..d.f.Xj...Z...~..c..{.@.....C..`......[........al..X.......R.D}DV.z...B.7n..Q'...,.......q..$..q..v.C....B..T...2..m..k..5e[.7............x....T.M...M.^?3d.J...[.....Z...S0.Ms..}`.....P(/.f....6K...<..)...=D..`....fb..^......px.h8..4.^.../........@.....q...uF.{.7...2.m..0?..:..vu......r..n.0s....Gs.....r...7.5@..@@....2...t[l.{.S..O..7#...7.d{...e.^@...>]..L..-oz.....e..!PE.dR...=.I.l.O\r..6`.S..`.._gxup....../........@........px.h8..t.....W................. {...\..B0..]....(eQ........T..Q5.[.\B..{...V.......C...!4({\...h.w.g..{..Kh.....l.X..v.p-..Z.^IA.:......ur.&..%5.t.S...Ch...NKgn..\.Pv..:..[(......8.nb.K.Uk...]..A.^.50..\B.i......4l].[.mkA...L"....v...2=.[.Yo..8.2..c`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_bd7b00_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.742716878205026
                                        Encrypted:false
                                        SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                        MD5:58C547F99E4570568CD2952820C60BAA
                                        SHA1:CAECBBDAC9FD46026BC49836C7904F36FDB6E629
                                        SHA-256:F9CDF7EB3066FDEEF555DD70443C240242234CA5B36AF240BD222A12EBFC88C8
                                        SHA-512:207D93EE3FCEAA828BABACCA4096B4993BF18A37D78F9B25264D90040CA4E53F08EB0827284EA509F12AF582A4E97B403132D0E092B92D3800C311F0762CCEC4
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{....o...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_d19405_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.776460888119716
                                        Encrypted:false
                                        SSDEEP:96:aNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:UHm231Nvu+wIqltWOe3nIP
                                        MD5:33811FD387B89600054B9B4D630CB7BD
                                        SHA1:47AC7CA3C55ECB67A81988BA4B281DE8435E745A
                                        SHA-256:68E40DA32A12AF442486BA0220013FF82A343036CEC671EFC2E0A5D4B82F4BBD
                                        SHA-512:77D0C1E6D9E50D80CB65A0254E34171AB668CD65BEE32BA81A2A706CAD774254B1B6EB3E43197D2DD5D7F776CE7223070F84B37BD22BBCFBD1566B90FD752EB6
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.........................................................................................................................................................................................................=q....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_eb990f_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.774483769238085
                                        Encrypted:false
                                        SSDEEP:96:8NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:mHm231Nvu+wIqltWOe3nIP
                                        MD5:5BED011F03268413C39AF392BF473E01
                                        SHA1:4349B6BBAF0D320D4F3BFE3747C6CA2F99F27FC7
                                        SHA-256:C39808377E9431C8964EC2FBFF597979A0F6DC8421D7483FA847FAC7D536E209
                                        SHA-512:19C910351FF5B47444F99D7625A4489B74D090E538B01E790F3A300457FAC8365F9220FE80AFAB6B927DD51D178672D6CF9778B1F6FF9A32A2BE2CC6B9C9CCCD
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...............................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_ed9f26_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.770555207484389
                                        Encrypted:false
                                        SSDEEP:96:fNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:XHm231Nvu+wIqltWOe3nIP
                                        MD5:776F11EB6071FB17D2E75711CE1E89D3
                                        SHA1:8354AD062CE0B5148719977311DBD23297F01579
                                        SHA-256:BB48194B1AF84D1A99F8F723286EA5F752D0DD76519207B677677139E7A77268
                                        SHA-512:281151539060035BB7F09739ED2ED2F959113EA1F8298DBC880924547BFE6C9B0FFB1CBB29D71A1CFBD72BF5D791065D31214BF35545075E0602960D54593607
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_fadc7a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.767152740736307
                                        Encrypted:false
                                        SSDEEP:96:zVNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:zlHm231Nvu+wIqltWOe3nIP
                                        MD5:E8D6D9F9DB95005603433CDC65F4186B
                                        SHA1:9BA6A7D43C9A9C1DA0432AB160BE638E87F89402
                                        SHA-256:D50B564FA87639E5677BF17E196A158AED18223B34B51EB866F0C9B06BE3BD8A
                                        SHA-512:BB9B0DF811F8C2508178A83609E0852DF6A851EFA89ECCDF20F24352939E7EC7A886B05A4A1F6AD600F533EE2B8CEA6E4CA88A1A4EC4473A653DFAFA05BE51C4
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..}!...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_ffe180_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.758025434515704
                                        Encrypted:false
                                        SSDEEP:96:HNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:fHm231Nvu+wIqltWOe3nIP
                                        MD5:480588FD701F6364B94ACE011BAFA5AD
                                        SHA1:0C51698F7DC2229D60AC2E526419D4B55B839023
                                        SHA-256:A5A52E32D7DE992033BC16D32E0DB66C5B367F1A38EDA828214C1F70AE99A54E
                                        SHA-512:DEC9ABB40B77F6074E1740351F7E8B785A7EDC14A173F3978821682C7D408FC1DA56E454AB557043FB25A2C5BDC7B27B67E92F4DB53839792BC17CD418B1C2CF
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................D@@....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36679
                                        Entropy (8bit):5.283625431419401
                                        Encrypted:false
                                        SSDEEP:192:10OW0C2rcBb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHx2Qd:Dr2b/+vaW1e07dF5fyFEuDS25u
                                        MD5:22BE2A4668EF7388D02F010F5687AF0F
                                        SHA1:755F83AD7BB15369A614494BA0E6278C0313B261
                                        SHA-256:2730A7FAF0B7C96FE8FEA5C4B1A403C2748F73A5DEEBA6C3E76544FDE765DF3E
                                        SHA-512:32635DF30CF7209ECC76C1D6DBC78C4FC4E12325F53B1012B21CA2190A4C56B2BB2FB787889C121C62873741F5BCF4842B0BF1AB43A3C5D654DA090AD51ECF9A
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=8px&bgColorHeader=817865&bgTextureHeader=gloss_wave&bgImgOpacityHeader=45&borderColorHeader=494437&fcHeader=ffffff&iconColorHeader=fadc7a&bgColorContent=feeebd&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=8e846b&fcContent=383838&iconColorContent=d19405&bgColorDefault=fece2f&bgTextureDefault=gloss_wave&bgImgOpacityDefault=60&borderColorDefault=d19405&fcDefault=4c3000&iconColorDefault=3d3d3d&bgColorHover=ffdd57&bgTextureHover=gloss_wave&bgImgOpacityHover=70&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29652)
                                        Category:dropped
                                        Size (bytes):31456
                                        Entropy (8bit):5.228582229143624
                                        Encrypted:false
                                        SSDEEP:384:Dr2lcR8lOXHc11ev98zWmk+4b6GUwQFSc7nfZBhV/:/BXHcE98zLwb6GUwQjBh5
                                        MD5:8A6695FD927DA4B1578BC0A55B07EDA0
                                        SHA1:82E9666B5E51982A1E2C1A072820DD3D077AA193
                                        SHA-256:26269D72781AEBEC6E130F76513B536C526BD524ADB123D83A7EC7D7F78B4D32
                                        SHA-512:B7FCA5F397A6C706AB6380F317C45475D580FB4D5250CB544533CDBDEFF3BC59F39A8AFC98CD9332EDAD59F7FF49D797384CAB99E9DAB2ED91DBF50478313EA7
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=8px&bgColorHeader=817865&bgTextureHeader=gloss_wave&bgImgOpacityHeader=45&borderColorHeader=494437&fcHeader=ffffff&iconColorHeader=fadc7a&bgColorContent=feeebd&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=8e846b&fcContent=383838&iconColorContent=d19405&bgColorDefault=fece2f&bgTextureDefault=gloss_wave&bgImgOpacityDefault=60&borderColorDefault=d19405&fcDefault=4c3000&iconColorDefault=3d3d3d&bgColorHover=ffdd57&bgTextureHover=gloss_wave&bgImgOpacityHover=70&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1381)
                                        Category:dropped
                                        Size (bytes):18025
                                        Entropy (8bit):5.092719134695988
                                        Encrypted:false
                                        SSDEEP:192:XQ2rcZ2QyMTLZF5fyUPtNt38EcvJmVzYRgmB0iBfT9RhS2wV53skuMaaSQhQz0iu:XNr+F5fyFEuDS25u
                                        MD5:6AA923C141500B3D7989C46EEF53602E
                                        SHA1:213C4CC09900A1CED6D8A01F05DF34FA0A0459BB
                                        SHA-256:BE3C9D96538238974D013BFF2FA18A89A800081BB71B5FB0D8F7A75739EFA47A
                                        SHA-512:8EB56EF1068E4ACF585CA62DBFBFE33270B6E7875571DADFD5869531C0AC02F7E9C5759C13F13EDC68B6257196991BBCE4268FD040D295052EE98DCA60601C50
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=8px&bgColorHeader=817865&bgTextureHeader=gloss_wave&bgImgOpacityHeader=45&borderColorHeader=494437&fcHeader=ffffff&iconColorHeader=fadc7a&bgColorContent=feeebd&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=8e846b&fcContent=383838&iconColorContent=d19405&bgColorDefault=fece2f&bgTextureDefault=gloss_wave&bgImgOpacityDefault=60&borderColorDefault=d19405&fcDefault=4c3000&iconColorDefault=3d3d3d&bgColorHover=ffdd57&bgTextureHover=gloss_wave&bgImgOpacityHover=70&borderColorHover=a45b13&fcHover=381f00&iconColorHover=bd7b00&bgColorActive=ffffff&bgTextureActive=inset_soft&bgImgOpac

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_10_4f4221_10x8.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):365
                                        Entropy (8bit):6.359300406286935
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPcUyKfp5Ej1aPRmg88IoROJvd762zgN+E893CEMl93SGp:6v/7UU9+JEoj8IoETzS+E9EMek
                                        MD5:0C4AD56477CD90EB0069DCEBE576132A
                                        SHA1:0AA318036C772188BEA996B19A08CED776CDBA58
                                        SHA-256:D1AD219B06B80A6275ADEFF7FC7C50AD93F5F67AD242E28D2EDCED087D0F0151
                                        SHA-512:5F642659EEABEA648BA3C85CB839EC49003CCB1F6547DE36285305651B9A68C3FB4F187A01B43F14C7FED2CFA87A5BC26ECBEC323B3D1ACFB75E84F340C67EAC
                                        Malicious:false
                                        Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......qIDAT..c.........:......`.a..~.Y...6.}..<7!$.C.piCV...F..''EE\.0..._...C.,...x.....@......W.C.........!.._a..."...R.S.[I...%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_20_372806_10x8.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):368
                                        Entropy (8bit):6.341460797434122
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPcUyKfp5EQ4w4iJoDa+J/uh+yRORCwh7zgN+E893CEMl93SGp:6v/7UU9+Qv+a+Vo+rcwh7zS+E9EMek
                                        MD5:90D7BAD55C1DB9844BCBF735DAC1F074
                                        SHA1:1AEB567353D7A6937979BA8D388D6190C9D7D2BC
                                        SHA-256:F3E3D4CA130EBC403DB3A0009B9FE2A52AD978D6E745A9ACD0FB7AB9657E76C2
                                        SHA-512:83F8F1664B8133187019ABADECA53A10BDE2E718FC12B6A66903DC970D9B62D95463C69D2067AC98B0882E2D04E781C8A893785195C0D2115EA8B83D2A05B40B
                                        Malicious:false
                                        Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......tIDAT..ctM6O._..>].x.}4......\.,.K....c.K....L..!+.e.........m....O. l.d..l.".^f ......W.C........_.#...\...l....dS..X.e...%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_25_675423_10x8.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):370
                                        Entropy (8bit):6.364510427201636
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPcUyKfp5E6nKyhIPHsKznqygKgj3vzgN+E893CEMl93SGp:6v/7UU9+6nB+fq7zS+E9EMek
                                        MD5:5AB9A60FB50076625FD74755BCE76859
                                        SHA1:6D322B4FE90AE0214ED49E065F3F774B29B1D3C5
                                        SHA-256:CB378A5778653E235F5A930201DE24E3EDDDCB820BA87EAFC690DEE381C34317
                                        SHA-512:0BFEA8A8A42CE5FD47DE2CC0E31080D940BADE666020792752C9ED339D69F0100486B6E091770ADF4B42B6A6BDA9347360DB78D671A3DBDD27DDFBECF75D2451
                                        Malicious:false
                                        Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......vIDAT..c,..\e....|..x.m3...-.W..E.a.M..>.+....L..!+.e.czzH..2.m....s..:.6.....o._V.....p..l...."L.}.?D.kSs.......`....][..9b....%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_25_d5ac5d_10x8.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):371
                                        Entropy (8bit):6.349255898525815
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPcUyKfp5Efw2TjvJM8e6Q8iUEb+vICiKzgN+E893CEMl93SGp:6v/7UU9+fwIJTVy5E//zS+E9EMek
                                        MD5:5ECDEA282139116CF454F59CD8F537D1
                                        SHA1:5B6C7458B943F228CA0DDAFB4DC49FCD3ABF9440
                                        SHA-256:9820FE8B19C77127DE4F323E5CE727B46AFE526288CADEF095C447E9D85BC5B5
                                        SHA-512:167C6CAEF5D76AEE93735927EC67FE891CA12870D0C6EFE904CFC8ECF021BB41057E48EAC649C4DE2EE9C8C20640590B3831FF0E11EB5B4A040D3BCBE94195AF
                                        Malicious:false
                                        Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......wIDAT..c...-{;.....c.e...e.G._.....ml"<L......L..!+.e...k......~.......G.%.-.....~....p.3.....a..+.!.x..u%gq..W.A....L....q...%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_8_261803_10x8.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):368
                                        Entropy (8bit):6.381127254253966
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPcUyKfp5E+pNMNEveuJHIYli8z3NaoG2zgN+E893CEMl93SGp:6v/7UU9+YmNEveupL9ah2zS+E9EMek
                                        MD5:855FF8ECC98B25F215023428712CE7DF
                                        SHA1:172BDB83B4167BF93E525409CB615AC084CDE564
                                        SHA-256:B3E3D422D3DC49E0E158E68C57D1CD26A50D61857ADA726D7CF64453AB162924
                                        SHA-512:3ADA1153E631BDF83CA5FA480615F8822B20D0CBBECC200C8E8063DD6C681622AD7F11524D3D5A053E0DADFAC201816248FD5DB8F69FC880CF5E868C06ABF9F3
                                        Malicious:false
                                        Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......tIDAT..c..[....~..U..6..`Sg.aWE.a....k..j...P&\...2.QMMB....6L...7....6.....?..T...p....}.?D......0..)..[..W.......P-.....%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_8_443113_10x8.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):368
                                        Entropy (8bit):6.3299103458725385
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPcUyKfp5ELxMOLyoPRvmkz1N6ipF7xnlKzgN+E893CEMl93SGp:6v/7UU9+LxnLyoPAI18E7dlKzS+E9EM/
                                        MD5:0A81FF0F2DDB965C675C7FB95A340BEE
                                        SHA1:992441E9D1E2E4C4CC35BE963EE7A9D87AA17BAC
                                        SHA-256:6BFDB6EEC896A086DDB70B06DDFFCA458579235B08C1FDDCDA935EF1079EEC6A
                                        SHA-512:CA6E45BE527F7C317F8458052D54721147B6DED81E8313BBB72E84F7090140D7583F391C72C981D5776CC29C316EFE9A45A96CF80112991638A41529D1C7A27B
                                        Malicious:false
                                        Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......tIDAT..c..h.!y......K.?..`.e...Y...6...].o!$.C.piCV...F..CCaa\.0....e_..Y.%........!............~_...F.7V..p..W.A....O,npW....%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_highlight-hard_65_fee4bd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):372
                                        Entropy (8bit):6.384221632259222
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EAUbEn19st28A04nqJ8qlRVgiFcSuf+vzgN+E893CEMl93SGp:6v/7WogU9+ALn3sXADn6lRVgoxQ+vzSp
                                        MD5:298B2329A688FE3BE43FF15754D3ECFA
                                        SHA1:77E39DA0BC3193E4B125ADDB9B6ED6BE0F0DD8E9
                                        SHA-256:C7324EDA15AC8ED7B7705EE989AC028480A654606B00A53CC588DDD53AB76A24
                                        SHA-512:70AEF10577B1E1522CEB34AB5FCE5D3DEDC3F457398F44BF728DE066058EE534FC2730FC0DD23FE219FDEF5AA9176769BF8BEE89C2D81D02F88258D367F62FBB
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......xIDAT(.....A.D.QW.XP.p-@B.G..h...*h....s......MHP.xc.o... ....x..*.].Dv.H^.,FO......&.btSO"..{...L./c%...r......!.B.:.P|v]...%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_070603_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.761923804558602
                                        Encrypted:false
                                        SSDEEP:96:RNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:5Hm231Nvu+wIqltWOe3nIP
                                        MD5:52076AEB12F3F4125FA6C5200DC2CDED
                                        SHA1:875EC60B0B5B04D87FF4AE44C20C4E555F6BC298
                                        SHA-256:A02BF13EFD09394F94DEB427F08EFCB57D8E22C03F85E6211E1542EC86561BE1
                                        SHA-512:65A0399BB73F911B28862CD052A94A19A072BE1273ACE7E6FC66C7EFEB68E3E35AD8FCB0E3BE74D23B8B4D002EB15237F8BAA46E9D79177F7C9BCF9D46213283
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................s.d...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_e8e2b5_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773782478619946
                                        Encrypted:false
                                        SSDEEP:96:nNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:/Hm231Nvu+wIqltWOe3nIP
                                        MD5:3F7E25352259F2D9287379BB49F4129A
                                        SHA1:ED8411A6BC4DAC4ED86FDC740C4FF513C9963FFC
                                        SHA-256:15A23E52BE0364E297B9E6915278E375F351CACC2C2ED9A5BB186DE125145086
                                        SHA-512:87828FE294E2DFF9C6D754ABC3336CE6E0998DFCF98C67B90BAEE1D5B6ADA88DE1F782942B3402E34A47EE2CAD0E4CC02F23A1968A362982C6CCEFBFACB552F0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................L.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_e9cd86_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773474449917077
                                        Encrypted:false
                                        SSDEEP:96:nNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:/Hm231Nvu+wIqltWOe3nIP
                                        MD5:D3F0FA26B37CCF94A53EBCC2406D5ED0
                                        SHA1:00B4CEFDE751F65A2A8FEF6FE17E15393E40BDF5
                                        SHA-256:0A4704D6AE092BC49A0072237AD91EA72C42025B3AC37E56D737D00057DBF64A
                                        SHA-512:F8EA60FCCA9C66931B66CF6C174B3DAE0E588BAB560D6371A84CBBA15E01BF6754D293A4EC94F0A53DD7E2CDA26EC0AB1C853EC17C7A79D112332670BCD5A00B
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................$.6....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_efec9f_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773201461632952
                                        Encrypted:false
                                        SSDEEP:96:9NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:tHm231Nvu+wIqltWOe3nIP
                                        MD5:766D9DE9AFB37ACB6D3B2D63E58624B4
                                        SHA1:C2690B02EFD7BC1995A0FD7134A2944B824F34FB
                                        SHA-256:749EA0F36E027265CCC24949F9F6B683F862E3B6B285F66C35ACEB258C79D6E7
                                        SHA-512:E899F5E3B2E195F89B167D5145BB1B304CA2E9AA1BF39872356FBC3FC003F747CDF5A36B3925B3AF68C3C90E22E2FA721226E1510CE518AB02A9272338CEB95F
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...........................................................................................................................................................................................................[...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_f2ec64_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.771441630990325
                                        Encrypted:false
                                        SSDEEP:96:ctNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:c9Hm231Nvu+wIqltWOe3nIP
                                        MD5:78A0CDD2A1CB63ABA98233AA0FAB4403
                                        SHA1:EBE3BCB06403818A400B345C63BB6702558C1583
                                        SHA-256:83AAB22FA7F0D3E71F02EBBA1E924193B043F4C73B11FDCDE09150A23B5E9C78
                                        SHA-512:EA2E9967D3DF3D5E40A03022F02389EE1B3D6C7CAB3B0CCEF9C34339CC4285C8404E680AAA47E8DC8E235EE47762D03225F2C40DDC3952A47FE41597AA483A55
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_f9f2bd_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.774286621668153
                                        Encrypted:false
                                        SSDEEP:96:ZNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:BHm231Nvu+wIqltWOe3nIP
                                        MD5:DB72B92A0F728CF5CA2E796BB8B16F14
                                        SHA1:01DA752C86E7E385F39D57EEF94727D90CF7DAC3
                                        SHA-256:C2ABCB934D66B1C551E084742E0627D22CF0DDF9AB2DBB350148785D2CB87F6E
                                        SHA-512:1DA590DCD1D670A6796135875E4EFA8577DA0148DC17C23323141E0368217D412A876860108354D9E5B1243759A34922258138F00231B8A615583782187824E4
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................'..2...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_ff7519_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.76872546534799
                                        Encrypted:false
                                        SSDEEP:96:MsNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:XHm231Nvu+wIqltWOe3nIP
                                        MD5:90D4B95F7F5018E66653FF33D32F35A6
                                        SHA1:0AEA94585C167FB945886AE060AF265690E11AA3
                                        SHA-256:5E8091D9C902F959F52E76DB516B55E2AAAC0050073A1815AA3A2DF53EA7E9CD
                                        SHA-512:68A8B2C2430E1AEFEE986C32B2C877A843E2AE9E94DA6A591860917C4316E35DEEE733EC69EB0368910EA5B4FD298234634EAF84EC9947A71AB3495E6FD3363E
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u....z...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36686
                                        Entropy (8bit):5.282561880141542
                                        Encrypted:false
                                        SSDEEP:192:10OW0w0b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHVjkubuh:E0b/+vaW1e07mF5fyWE/DS25Vc6KTq0
                                        MD5:E2BB4786D0AAD000C30B2034700B8C9D
                                        SHA1:3EB8126EB7DF461DC1FAECFE8BDA0E5815C0927D
                                        SHA-256:0F9F5CB35A2E81A3698ECBE195C723476ABF3BA3579AD162D1386E979AE7CA79
                                        SHA-512:7DF5F51BA647BA84F7DEBE1E4F3530F4D9C62F33B259AE514C35E7103276B34725D7D672DE7B8783DD50F19D3393373B3CD60862CB63E18C577F5DBEB76B0440
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Georgia%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=5px&bgColorHeader=261803&bgTextureHeader=diamond&bgImgOpacityHeader=8&borderColorHeader=baaa5a&fcHeader=eacd86&iconColorHeader=e9cd86&bgColorContent=443113&bgTextureContent=diamond&bgImgOpacityContent=8&borderColorContent=efec9f&fcContent=efec9f&iconColorContent=efec9f&bgColorDefault=4f4221&bgTextureDefault=diamond&bgImgOpacityDefault=10&borderColorDefault=362917&fcDefault=f8eec9&iconColorDefault=e8e2b5&bgColorHover=675423&bgTextureHover=diamond&bgImgOpacityHover=25&borderColorH

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29700)
                                        Category:dropped
                                        Size (bytes):31487
                                        Entropy (8bit):5.227925899943147
                                        Encrypted:false
                                        SSDEEP:384:E0lcR8lOXHc11evEUzamB+416GTosZSc7nfZBhVJB7:8XHcEEUzvx16GTosnBh5
                                        MD5:3E48471F78CD3C590DA3C207BCB629A7
                                        SHA1:F300E9EB2D267B0CD7BD3254D6007B385CC4B498
                                        SHA-256:921F677E244AD4D54DF0D63312F00E1D0708AC9B44BF66EEE22AFF4A5CC7290B
                                        SHA-512:7F3FD7267CF98193C2A74C222E6BC1F431B968A937EADDC0FB8F9BFF5EE6F2EF0E3F348F94926B05EFC00745C62FD46776164D5DBDB2C815FBED4BEFE929252A
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Georgia%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=5px&bgColorHeader=261803&bgTextureHeader=diamond&bgImgOpacityHeader=8&borderColorHeader=baaa5a&fcHeader=eacd86&iconColorHeader=e9cd86&bgColorContent=443113&bgTextureContent=diamond&bgImgOpacityContent=8&borderColorContent=efec9f&fcContent=efec9f&iconColorContent=efec9f&bgColorDefault=4f4221&bgTextureDefault=diamond&bgImgOpacityDefault=10&borderColorDefault=362917&fcDefault=f8eec9&iconColorDefault=e8e2b5&bgColorHover=675423&bgTextureHover=diamond&bgImgOpacityHover=25&borderColorH

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1364)
                                        Category:dropped
                                        Size (bytes):18032
                                        Entropy (8bit):5.089695775507098
                                        Encrypted:false
                                        SSDEEP:192:Xa4jkubuF5fyQLBRpBEcEYftrc5gmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqc6Kd:XaZF5fyWE/DS25Vc6KTq0
                                        MD5:282A7F8B37DBA43F8EDF8AF548CCB842
                                        SHA1:7C4348644E724E38D85B33BA6292E5502CE3194D
                                        SHA-256:74EFD4238A4123388DE6669D838E56DEC1872082B1381D1F42272AADDF35CB72
                                        SHA-512:6B143E179F98D1C6863AF85593B929F67E0490266EAE4BA4D799257BA8E268919DF21C66AE224866143DDA164771E3576FDA33A64D6780D32E10846C7A68346F
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Georgia%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=5px&bgColorHeader=261803&bgTextureHeader=diamond&bgImgOpacityHeader=8&borderColorHeader=baaa5a&fcHeader=eacd86&iconColorHeader=e9cd86&bgColorContent=443113&bgTextureContent=diamond&bgImgOpacityContent=8&borderColorContent=efec9f&fcContent=efec9f&iconColorContent=efec9f&bgColorDefault=4f4221&bgTextureDefault=diamond&bgImgOpacityDefault=10&borderColorDefault=362917&fcDefault=f8eec9&iconColorDefault=e8e2b5&bgColorHover=675423&bgTextureHover=diamond&bgImgOpacityHover=25&borderColorHover=362917&fcHover=f8eec9&iconColorHover=f2ec64&bgColorActive=443113&bgTextureActive=diamond&bgImgOpacityActive=8&bor

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_diagonals-small_50_262626_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):321
                                        Entropy (8bit):5.969095203566699
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP0CUyKOkp4/siKZDQ/45urzgN+E8VLEMlVbEbp:6v/7MCU9Z24wrzS+EELEMPS
                                        MD5:BEEC31422028ADA44E2FC9F0C67399B9
                                        SHA1:CFB2B656953BC92D85A4B24D1789AEA5466313D0
                                        SHA-256:768B45202B00BFABBF77CD80EDE985B94ADC9B4D235B7944F7562556DFF5481D
                                        SHA-512:27A02C3845C1B84631DDD0C067117AF1B9C116CE7029AFDFC7747428EF2F3C4796A87F0626701E7D1722F7D5460D6B222C53579B5EC526CADFD1EFF583879F29
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......IIDATH...1.. ...<xy....".0.-f(1..t7..LI...g.7W.ysR...I...1..C.1..C.1.......'.KZ.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_glass_40_0a0a0a_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):322
                                        Entropy (8bit):6.013416891415952
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkp4/76XEjnd8bsW2zgN+E8VLEMlVbEbp:6v/7JSUm60dcGzS+EELEMPS
                                        MD5:82027CE0F484A87E95BCB001765BF9D9
                                        SHA1:5481163B02AA1A4126B133D2A04714F373F653C0
                                        SHA-256:C447462D023313A40ED37F3B19AE0C252F16BCB9D9B0843B8915113A10E56A5E
                                        SHA-512:66C4A129AA5F8692620F29D21E244B5EF288A27F68B061DB755488910CC86C63D2374883E629D1B2E4A88780161B9D08331FCF31D1716729ADB58D056386A373
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......JIDAT8.c0Lab`.E........{*.?.....q.&V.&V.&.t...Ll,L.,L,..X.X*....\.....hH ...._-_]....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_glass_55_f1fbe5_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):406
                                        Entropy (8bit):6.5436702640430315
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+Toatzvld9u+UwWtDt66PWnOj2zS+EELEMPS:krr9+rvlcjxGnTzjEELEMPS
                                        MD5:3C091997535752F9243F6DED0C2E6698
                                        SHA1:850675BBB5B78120333643D19AA3E34176E5063C
                                        SHA-256:EA7A70F9E57E75AC0387E23CED494C0B76F5BDC0887AEE232ADB87BCE3EBD731
                                        SHA-512:0AFC12F899C5EF305581A03003414FDB097271F173D327FE8CA3444C77B29809ACCE3EB5D7265064DFFAAEA815128419D685D2101B3D90789F4D8AAC0F8C4186
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...!..`.........X..`...5.........ch3i..b..........g.._z.^........0...eU.$.mW..JD..2.'K.n'..@.JL ;.....9!..q.t.i[....=e...k..=.eH..RGi..a...y....9.u....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_glass_60_000000_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):323
                                        Entropy (8bit):6.029041180694467
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkp4/dlUD5kMFUuSSU38EE+gzgN+E8VLEMlVbEbp:6v/7JSU4izFUuFU38t+gzS+EELEMPS
                                        MD5:23B3F7DE6E50862D3FCCB373BB9C7B50
                                        SHA1:0D022B4CC99ED181474BBC7F21CA8186C402B3E8
                                        SHA-256:5A0C0AE716650BEAC2DBB4C97F016D3500597F422E84721B0709CBD946516244
                                        SHA-512:76730FAE5F0A4AEEDBC9D2385886EECF350D4F1A883DE59505FEBD6ADD31BC6791EF8508E2DAA3DAE9A19A6C6D1AC8B781D1B5A3E38890B64E628F0BE55AFB95
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......KIDAT8.c.-`b`.E........)...*......&.+L.W.8..L...0q\eb.bb_.....e.....w.(.......H.!.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_gloss-wave_55_000000_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):4360
                                        Entropy (8bit):7.896724830756886
                                        Encrypted:false
                                        SSDEEP:96:ft9jMnMxf4/vawA0p587C1KpYOgc1JMvh+r1PNH9:zmoh0pcCLOrJMvhG1Vd
                                        MD5:17C87F985475E4C876DEA26A1D0F2E2B
                                        SHA1:4D8D1A254AD38F5D9445C0B5F74A8E384281C330
                                        SHA-256:9F64350254C1884777FBF7C76DB07A027FBC4DB6B02EEC09462A23023F93574F
                                        SHA-512:532C8659F11720326B5C365F409391E799B6CF76AB4530E5F8C465E3BEFDC17EE5058C9B0C27C3A97617A4F1ABC4B607A4B5095076FF49985889F77D1C09FF66
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......<A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDATx..]O.%G..j...5..5!.b....A!.D..BB<D...'oz.W..9'.........s....s..w..(.!...&3....?...73/og.....?.......*..;.p8.9.v-....>.Bw8..~.;.{.....=._...../t.c...............p...Bw8..~.;.{.....=._...../t.c...............p......[.M.%...Si.8..^..R.--.M7."I.|.7/.v.:i=....b...j[..Z@.j.q[Y..|.l*.xh~......e).@..YD..SE...:Fl......R..{I.l9........%...Gj....s5..m.j4.....V..hF`.h.Q.V.u.h^.R..^.f...R.gZ".."......E4.........w,.....Vy.g...DB...../.W.#..q.....pl..uw8..~.;.{.......T|....>...(.....B..?.G......eQ.w.$..mS....rK....?D.YeNB...;..v.cj/...-...g.d_q.&...\[....}$..F..K-..%D.!.(c:.NG...RLZ.m.!;r..........5.~8...)R7....:._z.7...nG.....$..i8#..... .M..L.D....(.(...O.Fi.5.L..>N:R.......d..<k..6.i.#.c..^4qIt..D1Ya..|......].,.P?j.:i>q..F..$.y.7..N..IG..S7.....i.m$....QC%o.3+....f..O.L>.....R..a.OQ....%..[\....|.)..|%.J..,..........R...-./.....%Gx

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_gloss-wave_85_9fda58_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5998
                                        Entropy (8bit):7.68334741302507
                                        Encrypted:false
                                        SSDEEP:96:fH8ylGlwp2hEBlNwyr6H91M4/V4PgTE8GLySYhS26UD8B9YTaM71JhKLCMJLsDT5:P8yM+aEBwyr6fO8SO6UD8rY1JhKLNQDV
                                        MD5:90B65BE924BC8BAE9D724E2CC02DC0E9
                                        SHA1:39A5955C542327F2F8E3CED937B2CAFCBB11E8D4
                                        SHA-256:DE6AC849F1A18F2562015281888F0351C283765346EEE45065544B64994BFBA5
                                        SHA-512:B6588480410DAB2333E903442FE79230B73295A08D2773C4180738857E9A53A7D8A0CAAC6402B706C33457EA4C1F6073972EB492C45272C4BF365DB7ADC6E525
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......rIDATx.._.e.]..>......a..bc...I...$>...)L..V.L..UQcc....K ..P.v.b...!i.a.J.} i|.a.it .cT...}8wt_..|.k.}.>...a8..Z...}....b.>.6...[.~.........................`..........pp.....X.8...............V........+..w........;.............`..........pp.....X.8...............V........+..w........;......p...4l...i..S}..K,..)....>)...yj....W..BI...-.\....;..5=..x..*.)1..T*-o5......SW....U,xc.c.+..k..d-......(..[{}_-.'.+P.g^.{.5y...l...X..J,%....<c..W.z..f...........4..?.@]OR..Y....7.%.:../&...X.2JO;G..E...V.WC.\...ZuXbm........K.~..y{x]....T...o.._..d.....g*.nU.:...ws..<O......_|.O~..L........vk..........*.......pp.....X.&a....a=....\....{vGu{v...vlR..-..<.RZ...g.u.Tr.......6.G.....z+......v..b_Y#.(}.<US.y..tS."eM..S*.........x.7..z..u..........?.&.^.N\].SPj...7:o..\If.bL).."......a=.m6...N..l....s..K...>.m3e.k!.".yj^[.{..%.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_gloss-wave_95_f6ecd5_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5856
                                        Entropy (8bit):7.695827834591236
                                        Encrypted:false
                                        SSDEEP:96:fHaTHTdjK4IL2FpmiiMs3bDu8/UvKraICsvbjIPV7QAhB76Xgv8yrsKTBIb51OVG:PaTHTdjKpWmiDEbC88fEvPgxQcujO5uJ
                                        MD5:6AA84B2BAE200FBEAFD07E24AD43455A
                                        SHA1:B185CADC465B2F04276AF2A7E473423D20AA191C
                                        SHA-256:F42C18E0BF7B3002629A4F59437E189A9E64CD51B55277FB0DA138992899D016
                                        SHA-512:32742795C1E8FD697F9F453FD6A99AA80E96B8074E1505C44167F6E927B4B72C790771EB84DC0832B25D0374ED66D2EC397EF3C62968815EAAD2A415C1D3F756
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATx..O._.u..........".l.J..%1..]......P.P..n.0X.5.jw...-..q..&..iT.h\...4.....&v..E..7..^.oL......{....?.E2...s...s.{.y....s............9.n.......p.p.......\...............f........3..w........;.............`.p......0..p.......\...............f........3..w........;.............`.p......0...p.].:.EoO......oOYHE=..P._.F..e.yu.[.d....(}]...Z.3.W......M...VS..U.:.|}.b....k_.%..W..Z.w.%/.=DQ....>.9'....YV..sM.}=..}..X\U%.....#......|...C........Ufi.....S..')k.Y...7.ext.y_M.....z.Qz.s..\..j..z.Ze....).S.fY..f.....e{x]....T......_.%.B..o_.3Uv....oD....B.'^...._.8..*...........o...... .o........\..........n.eGm.9q.H.>.........3..'5...\.UJ.....u.u%.....(.+>....[S.D..K.."..[AcgY.....(}.2US.y..tS."eM...j.WWY...{W.p.7..z..u.........8?.&.^....WA...,/..=#.r...RR..`Ts.n......;f'...c..-..C......-.3.m.,{-..Hy..7.C~.<....k....B.J

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_000000_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):5582
                                        Entropy (8bit):7.907240701635631
                                        Encrypted:false
                                        SSDEEP:96:Yb/yH8NygIX6nLdhN93db9hmzC96Xn5J4S4UwYXE2wnlFMeB8M3lVwaK:O9DhNVB9p963j4U3E2OL18M3lKP
                                        MD5:7966D89AF8120E125F0FF69C09B0B848
                                        SHA1:D6BC3DB4E6BC8FE9AC99016D77D5DD613EDA8712
                                        SHA-256:9BBE3706E904C6BB15B897255F62E87955F0A35368EFC3CAD66383B07C27489D
                                        SHA-512:59B02BFC125F2902C72FF3712895B6E2CA260A27A3D430C9BA418601330B7C2B475243BAE072BB2685ED58716773D1B5160668FA21EED23C09C8810543215735
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....#2....tIME.....%...'E....IDATx..].d.U..v,.`.D.8..d%?D.!K..../.......C{...h.($.20.....&q/..q.f#..e...d....GVb,mf6!.[Dq2^.ay..Ab......=U......f..T..;.n.Su.a..a....`.0....3....+o......._....].".&^=..E.A0.S.w.../A<......:.............h...@..qO.W.FZ#...b.1..=U.V.=......................~...N...P...........U.v.:.W..9...0..0..0..0......'p...+Z..x.O.n W{.!....@_...}..IZ....k....c.?H.]..."..t2H..j..)U.m=@.t1-..q...w..R:...Nv..9....H..'.....3hY... ..r`...`..cW..a..a..a..a.".yg`.ps.....}.:........n..1.H..pS#.v.^AS.....g.{@/.%v|....c.. %T....Rn............R:..t...0.~.)...7W>..wYIO-~.<...6..^......{..n..0E.................v...#8v..?..._;.RS..N...b...N.1D..F..cL...9U....m.O.y.`/..}.a..a..a..a...E..u.N...h.jI..v.w.S.gY..+@..x.......!..&-. Z..LK..t..-.}..&l..h.......(.QJ...>...([..W...F..@{..pO[.fD. ...~cy...kvj.I..I.~..&....x.......I]7...Rj/._;.M..&..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_1f1f1f_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.92694681304517
                                        Encrypted:false
                                        SSDEEP:192:tVhcH5ZfLGSW2vWMqWNB76LeulcQVmpibEJi28h2O:XqHjLVWQWZWD76SuCQEpDJz8t
                                        MD5:A70FA5A611F0DEF8348F06C351A76F23
                                        SHA1:CF6BA7CC0A4D02E6D384ACFE69A6AECE3B9688A8
                                        SHA-256:3C569FC82FDA71677ED5A74C63F07428AB8EE88E21362D85272A6C17BE55F213
                                        SHA-512:E06C39886D6963DB6DF852F3D8BC4747A5A0054CEE2AC39FE3281F6F29EC0DC3D0D01A6B56DC2AE9D614C67E31D3E8B1A83126CCEBDF6710CEBF0906FD1D225B
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..'.......tIME.....%...'E...TIDATx..m...y........R `l..@Z.j/..K....m%.I...Jh.^.4!.R.....K`.6%..jmA.!.Km.. ...U.X..v.$.i..:4v.i........9.3s..;...s..y.s..y..`+.M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_9fda58_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.769365641768271
                                        Encrypted:false
                                        SSDEEP:96:6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:0Hm231Nvu+wIqltWOe3nIP
                                        MD5:49730AAD2088771F212C33FB18D3D65E
                                        SHA1:1BBB14E259D74C023FF328AB5AA75D8A87C9FBEF
                                        SHA-256:873FF4B32563F5D6D8650DA05E037F5F8422C6CDB579886D430548543B7C2361
                                        SHA-512:9DD054954326D56CCBB0F578CC99ADBD3A466DB9339F717CC26339286C2A712186D449329D5FBBC65AA24006C016C1AB716552999615D488D3060C7BC928249C
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..XG.1....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_b8ec79_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773633402963814
                                        Encrypted:false
                                        SSDEEP:96:6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:0Hm231Nvu+wIqltWOe3nIP
                                        MD5:4CB0A6D0B5C53EC1C5031AC876425E57
                                        SHA1:4A582B04720D4DD53685E8E0CEEE080308D90211
                                        SHA-256:210F3C33CA07E364B75644F215430214C786E88D177159723EF8D962007E2706
                                        SHA-512:087B5FD5B50DAA776C26738FFA6A6CBAC88CCAE00F871CF72A00DFAB89B38F591A7A5428CF9749DB33FDD85753CEEDD9A8C5298D1BC9031FD540E1127F86C70D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..:'...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_cd0a0a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739814671431308
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                        SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                        SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                        SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36666
                                        Entropy (8bit):5.284323041058013
                                        Encrypted:false
                                        SSDEEP:192:10OW0Cp4b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHh0Po/8:Y4b/+vaW1e07eSF5fyxHEnDS25gTv
                                        MD5:5DEEAF290D0DB83B7E3FE6FA2B76277E
                                        SHA1:D547DD72F0280E4E9C551713EE4D61438A395635
                                        SHA-256:41C6B4B69C19B71E04E9E6C1FAE9FBDAC2E97D1FBE4BFE34D110E121B5ECC237
                                        SHA-512:C4FBE50515A3052E763A49353D18E23CE1DCC773C997B571739B46DA05BF7A7591A0CC6B33B04BD6B5E29D21E0ED80235C86AAB976D5AF8EA9A67739A8A12190
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=9fda58&bgTextureHeader=gloss_wave&bgImgOpacityHeader=85&borderColorHeader=000000&fcHeader=222222&iconColorHeader=1f1f1f&bgColorContent=000000&bgTextureContent=gloss_wave&bgImgOpacityContent=55&borderColorContent=4a4a4a&fcContent=ffffff&iconColorContent=9fda58&bgColorDefault=0a0a0a&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=1b1613&fcDefault=b8ec79&iconColorDefault=b8ec79&bgColorHover=000000&bgTextureHover=glass&bgImgOpacityHover=60&bor

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29640)
                                        Category:dropped
                                        Size (bytes):31434
                                        Entropy (8bit):5.228656652836556
                                        Encrypted:false
                                        SSDEEP:384:Y4lcR8lOXHc11ev0mNz/mu+4U6GbzenSc7nfZBhVMC:8XHcE0mNz+2U6GbzepBhB
                                        MD5:35C76DACE5BB3A2E7F6B43B1BF3CD721
                                        SHA1:37E3D9A815A86F6876222EF509067E6020FFCB1C
                                        SHA-256:87E36CD9B3E0EA1769E0112DF0915859FF9CCA362A648F022A61C00930FF6C85
                                        SHA-512:A4C19C0E28F5E366C6F5E95BBBFB79AB513881F00F868CD92AF73C9723F77821D2C9D52F03744D451B1B3DFD54489E00D699DF250DBD83135A27B1A681189585
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=9fda58&bgTextureHeader=gloss_wave&bgImgOpacityHeader=85&borderColorHeader=000000&fcHeader=222222&iconColorHeader=1f1f1f&bgColorContent=000000&bgTextureContent=gloss_wave&bgImgOpacityContent=55&borderColorContent=4a4a4a&fcContent=ffffff&iconColorContent=9fda58&bgColorDefault=0a0a0a&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=1b1613&fcDefault=b8ec79&iconColorDefault=b8ec79&bgColorHover=000000&bgTextureHover=glass&bgImgOpacityHover=60&bor

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1371)
                                        Category:dropped
                                        Size (bytes):18012
                                        Entropy (8bit):5.093213207857892
                                        Encrypted:false
                                        SSDEEP:192:XQpY0Po/ActF5fyxxFzEcvYPPANNPmgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhk4:XudSF5fyxHEnDS25gTv
                                        MD5:B9372C0BA160BF67375785C6AA74BEE8
                                        SHA1:DC904367D60386F046664FD0ABBD46860F36E406
                                        SHA-256:0F740482C84A149635F253557D58CBBFAE95F19161722725BCC54D72DB0E3E3F
                                        SHA-512:602214B0CE53517AF6AE45E746A7C1D77707531E6EC10CDE51B9D8A85E21852F692E4258F8D81A86F750D6F30DDCF7F67EE3B7E36FDC2485CEC2D4D119CA3660
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=9fda58&bgTextureHeader=gloss_wave&bgImgOpacityHeader=85&borderColorHeader=000000&fcHeader=222222&iconColorHeader=1f1f1f&bgColorContent=000000&bgTextureContent=gloss_wave&bgImgOpacityContent=55&borderColorContent=4a4a4a&fcContent=ffffff&iconColorContent=9fda58&bgColorDefault=0a0a0a&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=1b1613&fcDefault=b8ec79&iconColorDefault=b8ec79&bgColorHover=000000&bgTextureHover=glass&bgImgOpacityHover=60&borderColorHover=000000&fcHover=96f226&iconColorHover=b8ec79&bgColorActive=4c4c4c&bgTextureActive=flat&bgImgOpacityActive

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_glass_20_555555_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):318
                                        Entropy (8bit):6.008561760794062
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkSrnLTR6MoHkyvzgN+Em6hp/KEMlOZp:6v/7JSUkrnLTR6BhvzS+Em63KEMlOX
                                        MD5:11F8721561696E039555A6D2BE1A53A3
                                        SHA1:2F5CFF5D9045BCDB1C28F398B5109A51DD30F0E3
                                        SHA-256:D3368B948E231CCA6EC8DCD9510FFCFB47EB046E9FB004C624523131EE5DE19A
                                        SHA-512:C13D384DE63CFC653F0F98792DAA6C9D2E0C8A9D375912CFF5660F034A1BE32A60A0A2C8C5203AA9F2866024D65FA71B54D3C7E3D699586D5CF3144D5C1E298C
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...FIDAT8.cH....0.F....H..{LL&L........11.ebz..t......X..h..x..Ai..<.....2l....<....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_glass_40_0078a3_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):400
                                        Entropy (8bit):6.518893987171985
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+NoYrIYYbfeZ5gzS+Em63KEMlOX:krr9+NoMzOzjEmdEMlOX
                                        MD5:6DF465DE070D719123DA33EABFD7F871
                                        SHA1:79C190E2E58B352CD16E41F42C5579D900C44014
                                        SHA-256:F4421025C0749891BF5259ACB8EEF0FFEDEB16364544921A363318A703F38291
                                        SHA-512:FEA771E97882FB6E09F6FC4475F404CCBDF5AFC6ABB41182C45A9DA55168845964C13AB80762582C997CC6D301014AE08AB6B7D4B95EA82F1CF52AFA06011075
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...1..Q...{.....Pa......;.0.uP)&..=.Uf.*Q(..N..J....V_.''92xn..."""..8..v..#E.z...@..B..kB...ZIE2.3....6Ia.-bJIE...m.D..c.1[.X..B......8....!.(gc...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_glass_40_ffc73d_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):374
                                        Entropy (8bit):6.401625747553546
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh1r+UyKfp5EuP6rs3grEM5E7e+Vn0g2zgN+Em6hp/KEMlOZp:6v/7J1r+U9+JrTFKe+J0g2zS+Em63KEZ
                                        MD5:FC8DF1573F4A44A8C6C1A6C10D3F2CBF
                                        SHA1:F520333BA8EF9554A754CF2E064C9FEC8E71C925
                                        SHA-256:5BD93AE714C82077AAB1B1171816B39514003788BEA55BAE3CB2CF27CF2925FA
                                        SHA-512:AB275E4F6BC5F5BB188FB174388927B2C9E4578943859ABA48F73A6FE74CB29D1F3BF4B05B4562236EB85A6349F3C9D8A611507252DCA6E64DFAA43597C17F0D
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...zIDATH.....@...}.......f....&..Zh..&..:i.N......O.Z..~kZ.@..A..^.....3..AcZ.TRc.&.....T.A...k..U:...'.z_...0....6..`f>.....A.....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_gloss-wave_25_333333_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):3976
                                        Entropy (8bit):7.8903193220578425
                                        Encrypted:false
                                        SSDEEP:96:ftf/8ADvO3/zZmSxLHgjyFaJxuf9ZaLDnAb:1sceHZnFaHufjaL7Ab
                                        MD5:06CF28ABF236C7E905E03E79C54C6196
                                        SHA1:00A5237473FAFA2FA1B5C9BAE9D3F5229928B4D2
                                        SHA-256:711D5BFD6EFBE4159B9316AE37B97C6597CC20BC41AA17B5D8FE1F41515BBB27
                                        SHA-512:57CDC25EFBDA108C1E5FC79D73F3CDE34030CB1BB7494BAFDB5FC07A5DFCE1600B9332153A94C73E150FE1D3FB518ED72945A1E89F4FF87F26CD9518C02F733F
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......<A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!....IDATx..]K.....,../.u..K3..a........o......{..)Dj.xa...|....,..EfVukZ.|..jV~..J.#..... .G..C.@...Nt...8..b..D'..... 6.Nt...8..b..D'..... 6.Nt...8..b..D'..... 6.Nt...8..b..D'..... 6.=.'.i.O...k'S;)......#..2r.t.q..z....q.&..Zar|4..%.G..H-...Y~.c.V..5_#.Z;L...l0..f.F.e^m....."~Qk?Fb....~.d.b/M..lZ./.!.A<r...(.Y..f...6.:..E.K..k.4G`.1..V......J..z..s.....tL.d6B./...k....CA..I.].h..c...(.:.w#.+....A...7...A\1.u'..... 6...d..5.?.$.L"2....._.7...b.9Q......,..+Y[.K..V.)..:..H.TZ.JKB.v.U"....B{H=......#1.......>..G.Gy...x.#...6.....a...i0.. G.4..[..7dG-.$"R....E.q..ocue..?."e../.K.R.K....K....n.BI..-.U..Cs.44.U.U.(....Z...&.2.....k.V~/.....=.e...=<4U?V4.=..5...4.....\..m..v.........n.r.....#A.6......1...I...!..Qw.....#..... 6..3S^...B... 6....b....?.H..}...x......Z..JG../X"...R;z.y0.L;.....t..M..$(.#..T.>t...V=6.}.]>..J......u...=..I5...y

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_highlight-soft_80_eeeeee_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):335
                                        Entropy (8bit):6.113278669095229
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkQravt0CSSZq1ekAYUlr2zgN+Em6hp/KEMlOZp:6v/7WdU5fSSs3A1gzS+Em63KEMlOX
                                        MD5:EEC6910145DAFFE21C779AAA9C255047
                                        SHA1:488063F1C1337971EE1166C864A34427BE063D91
                                        SHA-256:F45D9C0987A11738442831BF78EA54D622FD8DE3000B0C5D9D3D1E79087FBD92
                                        SHA-512:0F3085AA60EB013004674E91A3574807F630B47AC1B1852F4DC1A2FCF29CC39748004A69D07003C8B4AA565789B0723367581ADE792040AC2544EC50C637B570
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...WIDAT...1.. ........v0.......8.......W.8s..<.NPE......!.<..IEL......M.\.0..N.%4x_k...-1..W......%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_inset-soft_25_000000_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):312
                                        Entropy (8bit):6.034147603751223
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkgkblqwtB5W7Kf2zgN+Em6hp/KEMlOZp:6v/7WdUnBq+E7K+zS+Em63KEMlOX
                                        MD5:5F96013D83CA38E61881FBBF84F1BD01
                                        SHA1:F7F8FFF3D39F148DA1A4F2B95CCD19FB6E05B0FA
                                        SHA-256:67A5436E917759B5CA0965A74C3D603AAFFB3E36916A907F46DD6F3A3354219D
                                        SHA-512:3205093B7FA0C4E3926B314B0627B209FE338E7F07E15D9BE574A52F6B6C13FF0DAD7F8E407D557FAF0A086F5D29C2D2E6B807FA61897D92693E399364794A76
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...@IDAT....1..0.....@F(...eH{.....P......n4M......I)l..Fc.zH.>......~.....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_inset-soft_30_f58400_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):398
                                        Entropy (8bit):6.600503268336194
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+2XOILd7nEJIzS+Em63KEMlOX:no19+2XnR7EJIzjEmdEMlOX
                                        MD5:F97ADA5E876AD704AB2B72740A4FE25A
                                        SHA1:E3B4B8D5F26EECB796E312B0F7CBF4E9F013BD45
                                        SHA-256:BF98648A0DB139C7646766F107FD470CA0E18FAF90AED120B6428F07F8D83AFD
                                        SHA-512:6C3776E29DAAEBCFC07E41F7CCEAB7C811F3BE45AF0DABA328BE3B887A606E05BBD289E81CDCB2952224086BA7E7B86E03D60E6FF8DCC47B536B30AC01F0B616
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDAT(....P.D...B.".HB.Z$.c.k.;W08..Xd..!.......V...q.....|...?>c...x..[....%.h..s*...2.P.8....+*\.8y95..n....p....g.;J....u.h5...w.~.x.......6...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_4b8e0b_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7718687501842405
                                        Encrypted:false
                                        SSDEEP:96:mNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:YHm231Nvu+wIqltWOe3nIP
                                        MD5:853C2373C51B7B7C545D092D4A98B3CB
                                        SHA1:12270D908EAF7EC8C1D3491C4BFB00414911ED38
                                        SHA-256:FA33C9FAA259211591EA1C144246F1CB01B3CB18FD739FFAAE0A4965B979FF97
                                        SHA-512:89CCA39CACFF95B8DE1D1C29B8587EBABB91FCA2F91EAE1F491F3410C7549981E80FBCD188AF7DB63DF94ED7D2BCD301082C50E01B171308F76931EB2CD574A1
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEK..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K....]l...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_a83300_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.745691045674909
                                        Encrypted:false
                                        SSDEEP:96:PNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:nHm231Nvu+wIqltWOe3nIP
                                        MD5:372DD47E50840F48E9098AA30D978A5D
                                        SHA1:49F2C2A59C0A53F5400BC19F2F66E516699CDF74
                                        SHA-256:5D119EC862AEC3BE0B0722B651C5FEE065AB8255B0DDAD3D01E1A6B929B7DFA8
                                        SHA-512:9E24AAE1EE5750587C76145C557117E51A04E4B8EB0A56A4C2A88F11808118E2B33575B25AB2AD062A1B5862DFDFA7EDA2B11F5D15C1CA3DF9927D7DB81498F8
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3....g...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_cccccc_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7034
                                        Entropy (8bit):7.932139241999848
                                        Encrypted:false
                                        SSDEEP:192:K6OJJxfX8+p4/rF1km/zUCVbGarOXZuphvgXad4:K1JJxPzkFWm7UJZOJgqd4
                                        MD5:883030509884C748B039641F5955E85C
                                        SHA1:FA1BCF0D7310168CF3DD77A30CB527A31EEB6D5C
                                        SHA-256:055799E2F20C94BB0CD60D6AFB71D362DAA66AAE390032AB03C631C92FEC1860
                                        SHA-512:830C390394294C460D177FB4FC0D714D05994EAC8FEB5AD98C42876F204C8FE51983C31536C84B3DD6D8DC172E24555BA06E64EFB0BAC60CB3C5C4BFB7235814
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..8_......tIME.....%...'E...]IDATx..m..Wy.....(..R.....%..H.&.x.D..Er.....(.....D..........R....H.R;..H.]B......P.)mIX.b.R.*Ed.a^...w..;...{..s...sf...._..8k....,<...O..mB...F.. .6+.J.(.k....i.V....EG.$.......`....c........al.N..Z..._.)`Jy...<.z...B.7...N\..X.V...).)..!H..."&...!H.G.NP)~r..o.vX3.)...........{.>|DW75.9.z..i..\...2..g..w....*..cO.|o..n....m..By.....j.T&.y.JR.|.{.^.`....(5........l8<...O........h8<...O........:...2..n..6eL.h.`...y......Q.G.$....4`.*.7.^.k...R..>2...=@..lx..o..m.]..L.3_...0N;.......c..N..:...t..0..ny..'.Z....@.e.I.:...&r.....^.l..+..=.........O.5.....'@....px.4.....'@.q.30t..8._...t..../.0.....TW..c.......Q.... . )....?j......Uc...%T..g..l.......8T.K.B...%..A&~..F"....f....`.........u........H.(Z'.a.;PJ.WW]%...y..rs.Y..A>...}.....[(.vV....7pH..@..V...-...$y.....s.....@;..i.X...v.....Y.v...B....n]g.......W..c.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36634
                                        Entropy (8bit):5.280309221019183
                                        Encrypted:false
                                        SSDEEP:192:10OW0CQ8yBb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHoPSp:p84b/+vaW1e075F5fyFE+DS25u
                                        MD5:6A4AECFE4B9DD31564F28C2EE7B26DEC
                                        SHA1:DE0646DA25A11C6D4A853AE9B82C08EC3F2689EE
                                        SHA-256:46F68E72374A75AEA582DA3483B9E7E92730C1D1CA664FB44A4A8120C0766D39
                                        SHA-512:8471611D9A020AC06A0B827F3B9B2A8018F03741F6E4814B37C982BFCE34EE8750BF66ABB908390B7E31A4AC1B6316789BDD6A04116A0036156CDCC3459EA17A
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=333333&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=inset_soft&bgImgOpacityContent=25&borderColorContent=666666&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=555555&bgTextureDefault=glass&bgImgOpacityDefault=20&borderColorDefault=666666&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=0078a3&bgTextureHover=glass&bgImgOpacityHover=40&borderColorHove

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29572)
                                        Category:dropped
                                        Size (bytes):31354
                                        Entropy (8bit):5.223226346217589
                                        Encrypted:false
                                        SSDEEP:384:p84lcR8lOXHc11evqWhzkmV+446GpbZ3Sc7nfZBhVz:2XHcEqWhz1d46GpbZZBht
                                        MD5:237B0C1A24AA2B71B678651FC1933EA4
                                        SHA1:6F9BDD141DCD877D3F0FB66EB9EDBC9F04CA2BC7
                                        SHA-256:40E96918B8202A37FFC43EA78515473948913B9C6F224F0911D19A6B8C893C9E
                                        SHA-512:C2E28348BA0534B44DBE384925AA39DC6D0051B333667EBCFF5313E8A8880C84AA2C112EE3FE70A63256F44989D5F1204D577F2CFF0287CAA4B58DD154CCD187
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=333333&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=inset_soft&bgImgOpacityContent=25&borderColorContent=666666&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=555555&bgTextureDefault=glass&bgImgOpacityDefault=20&borderColorDefault=666666&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=0078a3&bgTextureHover=glass&bgImgOpacityHover=40&borderColorHove

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1359)
                                        Category:dropped
                                        Size (bytes):17980
                                        Entropy (8bit):5.084298001320604
                                        Encrypted:false
                                        SSDEEP:192:XQQ8yAPStd5hYgF5fyQPzH70EcS1poqZGgmB0iBfT9RhS2wV53skuMaaSQhQz0iu:X38cF5fyFE+DS25u
                                        MD5:D9952DDC64DD30C26F4F30685D7E07F5
                                        SHA1:F4DCBB31D47FA4E7C5A74BE86AF5CBC6C3905073
                                        SHA-256:A4B7629CBF15E6A2551F5BB0CFE25C501822BB59EA507B6FC2F8A3CB3F722CE6
                                        SHA-512:C30533286DA4ADAF46678A0CBC9534A223CA519993A19287A4D21991CCC0A981D8FF5039A391DBB358D68326E086015B4D3E07CB543EF56B1B8035666ED590EE
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=333333&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=inset_soft&bgImgOpacityContent=25&borderColorContent=666666&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=555555&bgTextureDefault=glass&bgImgOpacityDefault=20&borderColorDefault=666666&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=0078a3&bgTextureHover=glass&bgImgOpacityHover=40&borderColorHover=59b4d4&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=f58400&bgTextureActive=inset_soft&bgImgOpacityActive=30&bo

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):476
                                        Entropy (8bit):6.801036804973001
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+8DW7LM/9+RR7/r2zS+Em63KEMlOX:X9+DLM/20zjEmdEMlOX
                                        MD5:AEB4E9CB65DC390A7596D0F9A7372DB2
                                        SHA1:8EEBB6CE0A519300484787691BC4471550386FF0
                                        SHA-256:E8B26C78D61686274193C20EBE7D328E58A307E1231BB01C60001FD6D54F506B
                                        SHA-512:D44C4A994FD3BA1ACB33F01055CE171B7790508B0039A87CC070B1D12E5EF16D421F143EF1F650D1FEC167E092C46EA3AA84E297C165F3D2372BE7F52399E46B
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATh...1..1.F..6^@.-....y....'.k.Z....@.d..y..d...L..O..~2z_...}r.9oo.7[.......R.`65..@Ui]...-"U...q....G....fP..$j...`*..fS3p.T....HT...K......:..q.npt...6.I...G5.Tj..f...j...S..$j...`*..fS3p.T5vZ\..i.npt........h.p.....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):384
                                        Entropy (8bit):6.488096122297592
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP0CUyKOk4k55zD4o/qJjnauLAvxxMPNvzgN+Em6hp/KEMlOZp:6v/7MCUf55zD44gTayApxMVzS+Em63Kk
                                        MD5:490AC31FA93F68F9292323E037937BEC
                                        SHA1:C2721F24EB7F4DFF9254F173DA245F826E2EBD62
                                        SHA-256:D62EBBAA1B9AFE2ED31D82593110EF740389CDCF12D740AC31E4018AEB43F86F
                                        SHA-512:2E780F8A4FF5CEAA7AC8826E9D4FDFAF77B2A8253A93826610021EC6B059CD86D7E523F35D2F55CAD718ADABC0D3252F1DCCCF2EAFC8EFE4DAB4BC51E20E7AA8
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!....IDATH......0...g...8.W7.dn.../..RD...w......8US...].....5..*.q....n..u..p%.......Hp..p....r.d,'..M>..K...dC.0..@...E......os.)?..K..........%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):324
                                        Entropy (8bit):6.0982059449840005
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkMklPzwIZw//aLZ2zgN+Em6hp/KEMlOZp:6v/7JSUTlPEIKHDzS+Em63KEMlOX
                                        MD5:AE9CF02A88E37C02A866DAB3E4290554
                                        SHA1:994C07B326B659E422BA1E7FA898448FA31B495E
                                        SHA-256:7824BC7887AA24A3CE2669DCB8B1826852DC7092BAC93ED150EC3772DBD7DA15
                                        SHA-512:4D23AA236034FDED161E2713CC921E56155877AFAB93B1C711A1E3EDD3263845B0C7BF4C0B1FAF70F3679C5A4B37C22E2A5D50CBDFD7D17E2B1E1F1221FE216F
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...LIDAT8.c.5...a..".".o...K11.1|?..C......b.?.2..ab(c......."..%&.s&...w.(.....r...J.W...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):406
                                        Entropy (8bit):6.56964676945079
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+yKIfwBpTzj4J6qlVz7zS+Em63KEMlOX:krr9+1IfwBtz66qlVz7zjEmdEMlOX
                                        MD5:9A6AAE6A95E61B968FF869599BF14C1E
                                        SHA1:9551A9128C38366AB8029B3C263B4941483C265D
                                        SHA-256:8E15C1E7A06A156139CF1C42576CD2625AE9D5870CD4088B4CACEFE22CBC724D
                                        SHA-512:09E221A7689CD91D7B6CCD4C2FCD1EFE8FB0E7A45A792C62B3CB846B7A7B10E42EABE8780752F7EA918D574EB473826001CB59B253DBA8525C060CB5077FB68E
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...?.........H&]..(..v_.W`5_Ym....F........t.?....;=...eY<#...a..AY&I.R...h`.5.`........u8FD[..9t.F'.pe......z..=...W....].{EpK.:......_...0~....2UE\.....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 1-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):265
                                        Entropy (8bit):5.620668247500632
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh3EUyKO0kIojl2XIzgN+Em6hp/KEMlOZp:6v/7J0U0SXIzS+Em63KEMlOX
                                        MD5:ED31481B45167E6F49FDCB1499911BF3
                                        SHA1:4C129F32CABDF52B0EAE217A30360C3571390986
                                        SHA-256:15470C38D6F3194815FFCB9CB182EE4AED0C4E0839B7B5AB0A5FC1C6ECB67C63
                                        SHA-512:7C0199CF2FFB71B0CD5348E7171AC0E2263EBBB92EC8F4C8C659EDA552FAF1B0A34B3263DE0F044360F50E86DDB3CEA23F5CE1C63AC2C514789C58399397A0F2
                                        Malicious:false
                                        Preview:.PNG........IHDR.............G#7v....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME....."....!....IDAT(.ch`...p....h...4.i...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5873
                                        Entropy (8bit):7.6864989393853715
                                        Encrypted:false
                                        SSDEEP:96:fHCKpHEgefVb6uUwreFh/nDA+nwSmhOuP+0G9rEDq6b+6LyRAOiZcuWqPkD7MmMh:PCK5Egetb6uxG79whOumoD9q6LoAjZ7B
                                        MD5:437D053C3D8E0491DB75537CFAC2A614
                                        SHA1:CE6EADABE70270A7D8655BA847851C42B722EDBC
                                        SHA-256:A189DE8FE3307A4E2613B1FB3B57C68B2083EB8A9F76984E7A290363799920FD
                                        SHA-512:AD777191DBADFD2B8F1A569E7B4400FAB8566BC3FB9F2297C713E631130B9BBF965B8DB15F97FB85D70C045BCCB90623F1DA406C8148B74A8FB361796FC7FF8E
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx.._.g.U......LT..T,..`.....JI.<T.....<..V..Z|.D.e..`..$....g..p...&..%...|.36.'.P...0.{|83...w...............k}......ow..w..........6..u;......7..;......`......0.......L.6.........;......`......0.......L.6.........;......`......0.......L.6.........;......`......0.......L.6........f..e..worE..jc.^b.....:n..P...F..y.yu.-.d....^.....Z.3.W......M...fS9y..k9u.[.z_.7..s_..\+..%sA_m..x..Ea/..k}..X.@..y..}....#..{.c.*...?.6...?~...}?3T.....X..We..~...M..')k.(.U..r%...y_M.m..^e..v.V..r..f.WC.X...ZuXbm...e3/.y.........:.Q.....S7......G.uU.T..dvx#...^.y.x-G.......UA&.....h.<,....t.....H..2........;.........a..5..vw....q=...Gz.[....vn....W...Ji....].YWR..^T}....R.....:Q|.RRo%....YV.+s....j.=..U..nJU..)k.R-...........F.W..N...==..X...j..%o.5F......x..,..d6/..J..^.......U..Sa..e....+..1..c......m.).^.q.).S..:....S<.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):342
                                        Entropy (8bit):6.2013416841671685
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOki64dcmi5ukzUqmiGWDQ2sxzgN+Em6hp/KEMlOZp:6v/7WdUE64dcUdiGE8xzS+Em63KEMlOX
                                        MD5:D4FF4FB8DD6E2BD2DA63DB2AD6F4AE7E
                                        SHA1:9CCD0C1300ABB0EB5909F1A7EB725B163FE545A6
                                        SHA-256:E8AE5A6A366AD82330ADB5C9A2ADF03C61584B8BFD3D56020BAA5CDBE2F42946
                                        SHA-512:58341C7E93A2DF919B8EEEFFD29F0FF8DA3714029A8B14A7A4A230EB9A2B18DE88C650C1F0C4246699FBEF7E6ADE520E275307E529178700980F2E6385CCDD63
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...^IDAT..c.....@.....Q&.U.?$..ob.n...0.7o.....Z2|Y..E...\.."L...>11./g.....&..%..g..f2.Wdx..^..... ......%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):386
                                        Entropy (8bit):6.581871885288079
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+ihDVtRYJy/2zS+Em63KEMlOX:no19+ihDVteMezjEmdEMlOX
                                        MD5:8CBB1D31D59A19492034887A9727BC2D
                                        SHA1:A4A20C32539CDA455982CEB86BAED3571B742845
                                        SHA-256:0BF4E921028BDB28B10133B4EC93C298E18AC8E11181A3DD12645CF8A0B9F814
                                        SHA-512:B3F84BD0E92108AEF3F98A7BA6880590C404195D3A7E500F58DD918D81B614350927C4068379873FA4069D598B967D4132DB5B1C1645F2CA96706E2E03410A85
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDAT(..1..P.D.SZ.6.M....!r.....K.J....F...f,>Ao.`.x;.,,.cs....p......>.uQ`.i%........S).~.....rV..=O... p..l...:]....Z......O....?.q.|....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_228ef1_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.758680832020893
                                        Encrypted:false
                                        SSDEEP:96:LNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:bHm231Nvu+wIqltWOe3nIP
                                        MD5:A9245423A8C7BDEEF75E74AFB9AA4F2E
                                        SHA1:5ACD9E5ABF06E470FE3AB6CA2C68928D73AA419C
                                        SHA-256:82657B8AF718436B5035B97B0680DB73BC71A49E6E85E90060333515DB23CB42
                                        SHA-512:B54475A9F9690E0D907B6B627F61E36C934E8680D594990998A33A756A3D79D9659D3FA7473E0303A179EB32123681BA049A8760CFA8152994748104ED17CBB2
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."....*....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_ef8c08_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773765613279426
                                        Encrypted:false
                                        SSDEEP:96:6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:0Hm231Nvu+wIqltWOe3nIP
                                        MD5:5D1760802B4EBACA262C99F2E4C99E9C
                                        SHA1:A7194E4F70B0AF78478D4FD87996EAC871AE1B0F
                                        SHA-256:B68FBED9DB6CFDB2E895A583D02D70F84E3C6BD79DD6DF7D6CE4E269314649E1
                                        SHA-512:86F67F4EB53B85852964CE98B81FA4608AC319F14077865FF5E9ADBB58BAB686C4F805B90ACD26D026BB2075349668EDC65AF09AFA0CBB4F977C3641F530A1DD
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...............................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_ffd27a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.762337567109736
                                        Encrypted:false
                                        SSDEEP:96:/kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk4:/kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkY
                                        MD5:B1395D7A2A3288A98F8228E1EF360EC8
                                        SHA1:F9BC509291C758D04AD0EB9AEE287BF339C7EEC9
                                        SHA-256:0FA74A430333176F98075CCF436E33A020307586C76493C60B7F6FB111C1DCE4
                                        SHA-512:807401A623909AE49A0553D552C44C2F2C6A2A73E385C305F3989E7725BB2D124942325CD7293212B94D669B760675EA416F9687DD78869972231CF605BD6AD4
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36796
                                        Entropy (8bit):5.28435402116626
                                        Encrypted:false
                                        SSDEEP:192:10OW0k3b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHs+jVLlB:A3b/+vaW1e07BF5fyKEUDS257
                                        MD5:B7D9243F1C7B74709FCBCD7DFBB75E6A
                                        SHA1:6A89350F9A730ECBE7E3A605D24BA3CF86E03D55
                                        SHA-256:722982F556E40891116448DE1B410EDF8D448ED51E4D3EE00081A8D9E1DD72BC
                                        SHA-512:C6683EA031F7391C9DAC3EB0080B29C1AD327014C2A29385A30914CBE0BDC69F3A1C5DBA5C994941829D3BB92362B4FF32BECEC695AEB88A23B0C61B0BA13AF3
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=f6a828&bgTextureHeader=gloss_wave&bgImgOpacityHeader=35&borderColorHeader=e78f08&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=eeeeee&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=333333&iconColorContent=222222&bgColorDefault=f6f6f6&bgTextureDefault=glass&bgImgOpacityDefault=100&borderColorDefault=cccccc&fcDefault=1c94c4&iconColorDefault=ef8c08&bgColorHover=fdf5ce&bgTextureHover=glass&bgImgOp

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29724)
                                        Category:dropped
                                        Size (bytes):31552
                                        Entropy (8bit):5.228356829465387
                                        Encrypted:false
                                        SSDEEP:384:A3lcR8lOXHc11evF2+BzImH+4G6Gz5IUSc7nfZBhVY:NXHcEDBzZTG6Gz5IEBhW
                                        MD5:D9A6894D9BF9260FD94A1E062A165890
                                        SHA1:0845DF32B854BAA93DFC63645F1B221114BD72E6
                                        SHA-256:37B2B6F30FC6719EBD365170AA229BD5DE585F2DFB4D27E076E8F9810EB1F26D
                                        SHA-512:35A08E1907BC6ECEFF0712699E1678B787F8A6C3079EAB02C47FE8E1DDC616A052E3FD18AFFF3EBD9D3CABAEF9971EE9373EE5BC9E9F44F7E808D1CAC7A77F7C
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=f6a828&bgTextureHeader=gloss_wave&bgImgOpacityHeader=35&borderColorHeader=e78f08&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=eeeeee&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=333333&iconColorContent=222222&bgColorDefault=f6f6f6&bgTextureDefault=glass&bgImgOpacityDefault=100&borderColorDefault=cccccc&fcDefault=1c94c4&iconColorDefault=ef8c08&bgColorHover=fdf5ce&bgTextureHover=glass&bgImgOp

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1405)
                                        Category:dropped
                                        Size (bytes):18142
                                        Entropy (8bit):5.0948090465904405
                                        Encrypted:false
                                        SSDEEP:192:XO++jVLl/3F5fy9uCsEcI1/ePM2gmB0iBfT9RhS2wV53skuMaaSQhQz0iIhQB:XObF5fyKEUDS257
                                        MD5:02E006E56B3489170E1F53DB63E7EDC9
                                        SHA1:78FE0CC2E6A589A1991E91D1FC7A7F0F05EBED27
                                        SHA-256:BADDAEF2A6C7B3CFF023701084D1C01E827D534829B599C4F08C10BA0C249EC6
                                        SHA-512:E86DB4E092A72E76240A1BBC6B11187E817767580D6BD69B6FC0316D881CF8F7B3C7CDA940604FD7BA82A0424A906F0005EF44ED5A91CA3852DB3ADE198BF278
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=f6a828&bgTextureHeader=gloss_wave&bgImgOpacityHeader=35&borderColorHeader=e78f08&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=eeeeee&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=333333&iconColorContent=222222&bgColorDefault=f6f6f6&bgTextureDefault=glass&bgImgOpacityDefault=100&borderColorDefault=cccccc&fcDefault=1c94c4&iconColorDefault=ef8c08&bgColorHover=fdf5ce&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=fbcb09&fcHover=c77405&iconColorHover=ef8c08&bgColorActive=ffffff&bgTextureActive=glass

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_glass_95_fef1ec_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):390
                                        Entropy (8bit):6.447437739895353
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+jwk1em+2vEKvEA2zS+EELEMPS:krr9+EAvEJA2zjEELEMPS
                                        MD5:B64DE8410FA1D3A00CF2B1E9CCFB1258
                                        SHA1:A73D3BD96E2851565DB2F68DC4023FB6FE3FF204
                                        SHA-256:F1E63DDA49891B14FDEC86F5E76C606C89C249D272BFD03CEA169305752E73E5
                                        SHA-512:F052A9CF6D427482BCF8F9C59F8591C8F295D09238DCC9E709F9E39AD54BCC1E4D2708FC05F6CD6E2130A290E2287ED742B6170130030C95F1981E0909A9614E
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH.....a........\!V....J#X.....D}.....f.>....>...P..x...x......q....u...q...f.+..6....[..\.......W.T4r...6:.]V:...,.(....8..y.G-(d...H...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_gloss-wave_16_121212_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):4031
                                        Entropy (8bit):7.9028350895565165
                                        Encrypted:false
                                        SSDEEP:96:fNfyjyimoWx1aaf+xWkKCce0IBbsRQ0zIKJnQc5buTWliW:l9Zt6WkceNBbsKeHZl54WL
                                        MD5:39EF50F09E2809D49B8C00039CED3155
                                        SHA1:8DB6F2EE92A24C760E08590C9AEA79A7CB8FB848
                                        SHA-256:D98A434962B17AD62B8EB86FB75A5D2F2CEF2FE1ADAAC616FC79AC158519A5AD
                                        SHA-512:4527070C6C523C9BAF4C36FB650C7F0EEF1A21A3DF5238BED51200F1152B8F02DC66C5262AF8EAAC51A8DA53EB5C63AD0506A3B28020697CD4CC2D7EBC301629
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......<A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDATx..]..$G.~....-...|..].H...@.t...I$H.&C....H......@\@....s..4.!..,..3.`g...UW..y...'.lOu..Y5]U....... ..'... .W.6t.X....b.`C'..... V.6t.X....b.`C'..... V.6t.X....b.`C'..... V.6t.X....b.`C'..... V.......+U..j.VE.n?k..)....+.....xW..S....Bu|4..%.G..H-G..,?.1m.h....M..*.f.!..`...H..sW.na.._...x_....^2....`?.\e....q..]..'...N..S....'^..Zw..@..=..3.u.L.)....Fr;.n.-9....(g.n.E.G.g_....I.y.d.../.......R._.A.G.S..Z.. ^58.N.+..:A...Re..i.>H.A...".k.......XB..dOy.|-7-...R..:.....ZG<-..A.m..I(..R$."....R.f|.g.........~.......G.>...._....a.8.i0.. G.4..[..7dG-..d./. 2...-Z.b.U.........O=..+..7..M.Q..kK}.A...4..m.q.?J..Me.VS......S5..]+..{W...=.e..M%<4U_W4.]/.5...4..........v..........9q..b..5A.6.....1...I.....q.8].. .k.N......N.+..f.b.... V.v..b.8m..?O..+.V.|.A...>..ZA.(....`.P........T3.Pn....].6-kg..@..f..^CGm.m.c.........;....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_highlight-hard_15_888888_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):311
                                        Entropy (8bit):5.963006320820522
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/hWwaR7znGQ8zgN+E8VLEMlVbEbp:6v/7WdU8Q3GQ8zS+EELEMPS
                                        MD5:DBB10EF01FC9FF253FCDAA4D502DA438
                                        SHA1:D66A5B34D620576FC79C9A8A1E6F1E16D86AF410
                                        SHA-256:63CC98C1D36765DF5D7D186773D10E4EFE41DEEDE80A211D62157D7D94672963
                                        SHA-512:D4B7BC8781473E26898B2E1498A1F2AC36B29353C179FA651A381AC77B75E22ED477BB3BCC7A9C9414F5170539053EA04008EB8336927368E73899B8850D9530
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......?IDAT....A.. ......>.......S.^....2HF..$.|......6l.....y.>C......=.u....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_highlight-hard_55_555555_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):311
                                        Entropy (8bit):5.8924441889538794
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/hPHpKIzgN+E8VLEMlVbEbp:6v/7WdU8PHprzS+EELEMPS
                                        MD5:53626545F7AAD27A50909EB0FCF5BDD8
                                        SHA1:3AAE3D8D43A7B3E082CFF70E980760AC5BA6B3E2
                                        SHA-256:C20A901E1AEB67A3A73BC491285DF74AA29968A42C1FC2922BF0D60B5821B1BD
                                        SHA-512:9A2A72742DD65724849419A8F87F9D3AEC113A2E3B30009EE564962E8F415FC1D5C1B778D5A792D60992DF07DF11BF5DD07562965A7CF4AD4CE5F187ACF4C75E
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......?IDAT..c.]...0ph!..L.60....g..os...L.o0...e....7.........N.&... ..qz......%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_highlight-soft_35_adadad_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):326
                                        Entropy (8bit):6.061424992259731
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/skdptAGvHbsrpPQfzgN+E8VLEMlVbEbp:6v/7WdUAsGjs4zS+EELEMPS
                                        MD5:E07630E0B48EC08F0FF665666C6B6E4D
                                        SHA1:79E5622B1E1207D0C45EAAB8ABB61084DC828280
                                        SHA-256:250FE740209C0879C091AF3452E8D7036D97AB24D2CA698F133FD207608B7337
                                        SHA-512:034260637492FBC28756FBB1D306BD3490B3AD15A8A7D6CADF87AADD3CA0F7E9AED747EF4B4CD300B7915F9995949728ACCCDD6F199351B7B26CF2A7AF7F15A9
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......NIDAT...1..@..7.D.;..'......D.,.t.L1....B......w.xA..7.>.|...-U.k..:.....;....=....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_highlight-soft_60_dddddd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):342
                                        Entropy (8bit):6.127798978260897
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/oZ/OMpxD2zgN+E8VLEMlVbEbp:6v/7WdUpFbxD2zS+EELEMPS
                                        MD5:9AD2D7E521846940F3869A9E4F73C380
                                        SHA1:DF24CC6F8682C785CAF0D48F3D29731068F9EEDE
                                        SHA-256:C74EFD53A0F5365611439393F36B7A8F2EA5E600BBE6188C7CF384EA407BBFFE
                                        SHA-512:68E7C6681411D8F7E48D1E4AABBE7D8DF5B6FB7F98951E738FDB095577BEFFF2B687D451A91ADDF2046A283C24F1A64E70A2FF1EC87D8C4B580FEBAC1D398032
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......^IDAT..cx....@.....L..../.1.Hbx~..3........0<9..D...4.......0<x..P.p.>.}..{/..Z..I3.?D/.bA...!..@W....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_inset-soft_15_121212_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):322
                                        Entropy (8bit):6.09678954068526
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/bTe9X+EsoZ7kbzgN+E8VLEMlVbEbp:6v/7WdUiTe9XFJQbzS+EELEMPS
                                        MD5:956014D41F5BC21A2C79090E1DC83D59
                                        SHA1:E8FB0A5D917390E211261CF172A95A8B2E06291D
                                        SHA-256:E394A321626DCFF17847269BD861229BCFE6F09CDE8922CFD35608125E6ADE09
                                        SHA-512:03C95D321B7DF9D8815551628A044ADC95D2AFB386481BB6ACDF4C9711673ADAF1B05C57B4A2C30C44A02252A6F2BF8AF03918A2CD46E4FDF6C3BF76D7A3F6F4
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......JIDAT....1..@.D....-.m..v..b..%..*,@..<....C..N\x.......rC..w\.......l.L..P..t#...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_666666_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7111
                                        Entropy (8bit):7.928455943008907
                                        Encrypted:false
                                        SSDEEP:192:eMzXuohHXyFN1Ce1gydd84kWORcDrbeq3ek:79HXk1t1gMd8WOkrbeUek
                                        MD5:D779CF92249EF61590F0B6FA32207423
                                        SHA1:5D0223055783B026D13CCF508FD54317B030981E
                                        SHA-256:18257A1FC35E3B8C129E2EE60DA4B617703FE80E43F8D8F3052614BF7AA8CABF
                                        SHA-512:440349B6C97F034C635D731A128EA0A637867EA971631B7A0F4835EB92FD2B7F892B1AFB9CAF78681FE36EACAC8C179793159A29A2052B0F561295C359B31B36
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.f.\._....tIME.....%...'E....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>............d.5..x..^.../.2.........mV..&.@..`..MX9......$)...=.,...0L.L...}.0~z[.....J...5..S.#.G....p_....I;,.:q! `.X% 0.\..C. ].H.....B(T..(..R....o{vX3.)...........6h.>...XhN.^.4.Ab....!CPz%..Lm0..m...m..n....m...9.c.....].=.UL.W..W7..)........6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u.....(.#%$....4`.*.3h...5m..m.......5@.. .~5<.e..........n.oF...|..d{...U.^@...>]..L..-oz.....e..%PE..f......$\..')y8J..^k.._9&.t.;..o2.:....A.......@........px.h8..4..7..:....._+-..s.E.K%.2..5..UA...(.<..`......+P..3l..X..S..G..n%p.U".YR.[..........R...q._`....P.5`..Y.BKl.5b)....Z|.......t.Q.i.E.. Lc.J..t.S...Ch....Jgn.b..(;...Z.-..tVk.n...R71.%.5`j..i..@/...uq...4s.h.`s....... ..]&.Ua.q;].A.....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_aaaaaa_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7075
                                        Entropy (8bit):7.9303849833121305
                                        Encrypted:false
                                        SSDEEP:192:UXTvYXQzy0RbWcAt87YE84ate0UEXUj/SPoH7:Ux1fS87YE2e3E4/6ob
                                        MD5:576B05CC7D15F49E870CF358D041772B
                                        SHA1:9E461C8365CE53C0DD69BF01FD3E08C15E893CEE
                                        SHA-256:36CEFEEDA29F3528EEFB7595CCA0E15E9624E7746F0F19A66EA099CC3B4833BA
                                        SHA-512:492DD4EB32D24FE2ECB33C1716D850135ED17B8C928F114837587A5AE0FAD3191A51946AAF9957411B1AC17363BAC33291EEABE53B0A24A327DFBFDB9D7FD1EF
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....i.....tIME.....%...'E....IDATx..{.$G}.?m;....!.>...l.0.][..HX.M.K....E.....)r.8...{....?ptg..Y.G.. ...b...'....8$.f..;.#...A..G......3;...=..L..........W..<................&.=.Ll&<.D.Y.V.D.^.`..O..r..`.:.$)...=.L.s....L.=?..a|..6...I#V+A...1.L).P.!......)$q..<....U`....r.2...t. )b....B.zDD....'O....{.5....[.Y.`..]az...GtwS..S..l.. 1.z..!(..h~.L.`V.U..{..g.ws...l.g......p.U.f.2..CP.....C...[.mVF.y...h8.J`....px.4.....'@....px.4... .w...d...p...)c.F{.....S.......>R$)g...3W....i...mk~[.+.O}.#c.P...._.OB..mz.-..=.)w.....i'.#...@.].S/..c.>]..L.[.......e.%PE.dR...=..\..').W..0..k.0..o2.:....A..'@....px.4.....'@....p.3........._+-..s.E.K%.2..5..UA...(.<..`......+H..=l...>0.b'G..n%p.U".YR.[..........R...q._`....H.5`...@.%6..b)....Z|.......t.Q.i.E.. Lc.J.xw.]..K... 7...........$0txzl.\.Y..wk..!uS...[..L..K..:(...f].K(......lN...u.'.vw.IdU.)n.K9(...u..f..c/.<....

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_bbbbbb_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7092
                                        Entropy (8bit):7.923076697213992
                                        Encrypted:false
                                        SSDEEP:96:+bdL0XdnQW8FLZ3Iz6QlfUGxGO7TjLZxkSR5jsUeuOkjFWr4n2Otk54c+tEBNrDb:ykSFt+7/xpT3Zua5gewr4smcZrDaIx
                                        MD5:947F1A81E0EEECAD8A78B92B269E3C2F
                                        SHA1:4ADACD01B707EAF141426B565937D0651EE0F808
                                        SHA-256:748E923944BED881A8384BD8F6A90D83BA56C30B3FDA34E77A3A2EB3381518F1
                                        SHA-512:41C5907FA5532A13490E462CB9D5218FF06CC8B0C40DD29FCFD4BA55FAC3225D0B13A55900A3CD77B6ED36996A003D52C63A90622AEF6DB6353009892A6BE1B2
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD...>I6....tIME.....%...'E....IDATx..{.eE}.?.H(bX.1..[P.`....J.H..Ef..M.b...F....,.3...`V.;..!.]..E.<.K.@U.#"..-.gWEBL"8+qW..q.#E,9......9..w....{..u.........u.(.M.i..G....... .EH...Hx...2..$........+.\.....8..................FOoi...3.Z...W".0.<D}DV.....B.7n..Q'.....+.....q..$..q..v.C....B..T...2..m..k..5e[.7............x....T.M...M.^?3`.J...[.....Z...S0.Ms..}`.....T(/.f.}......<..)...]D..`....0.../..._.l8..4.^.../........@................=..E.M..2....`gO.{..:\.}....=....\.z...\..mc.-...>....(....W..P&}..n..b.`.....f.Q...P@..P].Xq...a.............jmP.I..U.A&..........%..`.._9u.......W.7.~!.....px.h8..4.^.../.......~g`...q...Zi...Q/zO*..9..9......C..! .....?@X.R.U.a.`}`L...Uc...%T...I.l.......8T.K.B...%...&..{FL....f..-.....g.....u..t.....H.(Z'.a.;PR.OW=%n^.<...9.t.f..e.e'..C.r..jm...C.&...[..LM.%m{...e^....%..f....lN...u..d{..$.*."n.K9(...u..f..c/.<...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_c98000_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739641524249667
                                        Encrypted:false
                                        SSDEEP:96:RNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:5Hm231Nvu+wIqltWOe3nIP
                                        MD5:3F3E1F1DB74D1AFEF12705208908F54E
                                        SHA1:D11DE5DAF044246304F892AE14BC11929467D537
                                        SHA-256:98A8B1A6BFA2BFE849A2B5218A12B0BF89DAF37C0CE965B706BAB11D01CFDD76
                                        SHA-512:84587950460A23FC3A9DB512B0D4D67C6B457DF84E4DDCDB5E58285C0584A37ACB51645570E5D7E5388A6830734FDF67DA02F057A2CCEB11D044864BCF166A77
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................F5r....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_cccccc_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7034
                                        Entropy (8bit):7.932139241999848
                                        Encrypted:false
                                        SSDEEP:192:K6OJJxfX8+p4/rF1km/zUCVbGarOXZuphvgXad4:K1JJxPzkFWm7UJZOJgqd4
                                        MD5:883030509884C748B039641F5955E85C
                                        SHA1:FA1BCF0D7310168CF3DD77A30CB527A31EEB6D5C
                                        SHA-256:055799E2F20C94BB0CD60D6AFB71D362DAA66AAE390032AB03C631C92FEC1860
                                        SHA-512:830C390394294C460D177FB4FC0D714D05994EAC8FEB5AD98C42876F204C8FE51983C31536C84B3DD6D8DC172E24555BA06E64EFB0BAC60CB3C5C4BFB7235814
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..8_......tIME.....%...'E...]IDATx..m..Wy.....(..R.....%..H.&.x.D..Er.....(.....D..........R....H.R;..H.]B......P.)mIX.b.R.*Ed.a^...w..;...{..s...sf...._..8k....,<...O..mB...F.. .6+.J.(.k....i.V....EG.$.......`....c........al.N..Z..._.)`Jy...<.z...B.7...N\..X.V...).)..!H..."&...!H.G.NP)~r..o.vX3.)...........{.>|DW75.9.z..i..\...2..g..w....*..cO.|o..n....m..By.....j.T&.y.JR.|.{.^.`....(5........l8<...O........h8<...O........:...2..n..6eL.h.`...y......Q.G.$....4`.*.7.^.k...R..>2...=@..lx..o..m.]..L.3_...0N;.......c..N..:...t..0..ny..'.Z....@.e.I.:...&r.....^.l..+..=.........O.5.....'@....px.4.....'@.q.30t..8._...t..../.0.....TW..c.......Q.... . )....?j......Uc...%T..g..l.......8T.K.B...%..A&~..F"....f....`.........u........H.(Z'.a.;PJ.WW]%...y..rs.Y..A>...}.....[(.vV....7pH..@..V...-...$y.....s.....@;..i.X...v.....Y.v...B....n]g.......W..c.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_cd0a0a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739814671431308
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                        SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                        SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                        SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_f29a00_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7508488222392184
                                        Encrypted:false
                                        SSDEEP:96:cg6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:cg0Hm231Nvu+wIqltWOe3nIP
                                        MD5:E05F6591588CD86BE9D6A498A5EAB45A
                                        SHA1:5BCC7AA52043087C1BE8D139E21E38D6F788B572
                                        SHA-256:ED4D5B2DFE4CD278A8F797F68AE75A40EB186FCC932D30A85EE4A7491635191D
                                        SHA-512:87783EBA19C69FFC36E7BF7199EF2EAF1FDD7AFC2B1D7BA24A9B20483CDABC81AA7458D19560C69D3EF7A14653B2454524CB99A3003CB43CAF3F85D9FC5BBF8F
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.........................................................................................................................................................................................................b.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36432
                                        Entropy (8bit):5.2687503977040855
                                        Encrypted:false
                                        SSDEEP:384:BNynb/+vaW1e076F5fyfEVDS25Vc6Kvlak:mGP7wDS2vc6Kr
                                        MD5:498FA98DD64941C89E7F4B3D1C80C9A5
                                        SHA1:7915CBD12C96C14602311920A64FB2D0B006C634
                                        SHA-256:D15D714E3DF34F5FBAAE39857941A05315A6CF2F7BD0ED547649EC3F6D1FB80A
                                        SHA-512:7A42EBBB122906601399A4861C653645D5DAD0B27E99E47D9448FFD971296716500E2A16C7D94AE0539C1419847BBBF93BAA32D20D61D9356038FAB0CA5F8745
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=888888&bgTextureHeader=highlight_hard&bgImgOpacityHeader=15&borderColorHeader=404040&fcHeader=ffffff&iconColorHeader=cccccc&bgColorContent=121212&bgTextureContent=gloss_wave&bgImgOpacityContent=16&borderColorContent=404040&fcContent=eeeeee&iconColorContent=bbbbbb&bgColorDefault=adadad&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=cccccc&fcDefault=333333&iconColorDefault=666666&bgColorHover=dddddd&bgTextureHover=highlight_soft&bgImgOpacityH

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29605)
                                        Category:dropped
                                        Size (bytes):31158
                                        Entropy (8bit):5.210561486546047
                                        Encrypted:false
                                        SSDEEP:384:BNynlcR8lOXHc11evtRzWmni+4s6GxlElSc7nfZBhVBWGc:fXHcEtRzLnSs6GxlEDBhQ
                                        MD5:65B8A4440ACA66315F32B3D942F89561
                                        SHA1:6F9F79ADB2BB1E55AEF68C17EDA5ECC3E2FC3E4C
                                        SHA-256:12B16CA33D3957B5F89BE9F5E2E8FDF444D1DDE91C3D63122BE11A0731A5DF14
                                        SHA-512:68E6350CCA7F10E86648802E24522CAD7467936C12AD407B04AE71F875379DED132332A29C49228849C88442D46E0B2650353B53D60E3454A78F08D1A17EC65E
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=888888&bgTextureHeader=highlight_hard&bgImgOpacityHeader=15&borderColorHeader=404040&fcHeader=ffffff&iconColorHeader=cccccc&bgColorContent=121212&bgTextureContent=gloss_wave&bgImgOpacityContent=16&borderColorContent=404040&fcContent=eeeeee&iconColorContent=bbbbbb&bgColorDefault=adadad&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=cccccc&fcDefault=333333&iconColorDefault=666666&bgColorHover=dddddd&bgTextureHover=highlight_soft&bgImgOpacityH

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1130)
                                        Category:dropped
                                        Size (bytes):17778
                                        Entropy (8bit):5.058569194973011
                                        Encrypted:false
                                        SSDEEP:192:XLNyD9Mte6NF5fyjPBqcEco7xqDNYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqcN:XLNy4F5fyfEVDS25Vc6Kvlak
                                        MD5:9F76BFD262C02609A1781985C10DF2F6
                                        SHA1:9237E5ADD22EF6D14D6E57C224D5DA817E198101
                                        SHA-256:1413A4DBB8960D4CED5A71F06C31064A41ECBD2AB08E0B5438403207A274B47A
                                        SHA-512:8F30C2BD6F9AF99E13CEF3F97D44209AD330572332451274FF10CBE36E850608F1DC4637422283F2B5BDA0F37F056D5EB54DD6F4658EFA423B47A11B322D801F
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=888888&bgTextureHeader=highlight_hard&bgImgOpacityHeader=15&borderColorHeader=404040&fcHeader=ffffff&iconColorHeader=cccccc&bgColorContent=121212&bgTextureContent=gloss_wave&bgImgOpacityContent=16&borderColorContent=404040&fcContent=eeeeee&iconColorContent=bbbbbb&bgColorDefault=adadad&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=cccccc&fcDefault=333333&iconColorDefault=666666&bgColorHover=dddddd&bgTextureHover=highlight_soft&bgImgOpacityHover=60&borderColorHover=dddddd&fcHover=000000&iconColorHover=c98000&bgColorActive=121212&bgTextureActive=inset_soft&b

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\jquery-ui.min.js

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (32073)
                                        Category:dropped
                                        Size (bytes):253668
                                        Entropy (8bit):5.1428695015347285
                                        Encrypted:false
                                        SSDEEP:3072:FkHOJD1g7SV7opRBXDrtnAcKYvFJi/5PLO1aG0qF2/nwOW16j:qp/KvjOVlFYQ16j
                                        MD5:0A497D4661DF7B82FEEE14332CE0BDAF
                                        SHA1:F77D06B0C5DEDEF1F1DB051A44A2B0D7F233BA3A
                                        SHA-256:55ACCFF7B642C2D7A402CBE03C1494C0F14A76BC03DEE9D47D219562B6A152A5
                                        SHA-512:E036A2057F2BB203A805234B71E43F222C4317EB940D5D2126B417FCC27D470259083A9B129D048C8428746C6CCCFB53A7095E9C9CE74768E48035AA8F81ECF8
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: widget.js, position.js, data.js, disable-selection.js, effect.js, effects/effect-blind.js, effects/effect-bounce.js, effects/effect-clip.js, effects/effect-drop.js, effects/effect-explode.js, effects/effect-fade.js, effects/effect-fold.js, effects/effect-highlight.js, effects/effect-puff.js, effects/effect-pulsate.js, effects/effect-scale.js, effects/effect-shake.js, effects/effect-size.js, effects/effect-slide.js, effects/effect-transfer.js, focusable.js, form-reset-mixin.js, jquery-1-7.js, keycode.js, labels.js, scroll-parent.js, tabbable.js, unique-id.js, widgets/accordion.js, widgets/autocomplete.js, widgets/button.js, widgets/checkboxradio.js, widgets/controlgroup.js, widgets/datepicker.js, widgets/dialog.js, widgets/draggable.js, widgets/droppable.js, widgets/menu.js, widgets/mouse.js, widgets/progressbar.js, widgets/resizable.js, widgets/selectable.js, widgets/selectmenu.js, widgets/slider.js, widgets/sortabl

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\payserver\www\vendor\qrcode.js

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):56694
                                        Entropy (8bit):4.735778390117143
                                        Encrypted:false
                                        SSDEEP:768:pRAGaUobYVVPh7Inoh7SlSKrnef8mLtEYbNyfPVrhZv9wy0aQiCIHjCg9/GAgwho:BaUo2Yoh7SlSKrnefJSY5yeac
                                        MD5:6E6189E2B177B3D014321EDAD68FD73C
                                        SHA1:4C79BE1679603EF9691B98A90617AA1E534E93EF
                                        SHA-256:18AE399F81182BC9DE916E9C77B195DF20CC58D6F2D55A62B085A299F1BF1780
                                        SHA-512:E96386EFA01773CAE582D1982C684383B948CD91B609CF95AD26A6BE0A5E0588316AE1AEA0CB9AEAE2A59783AC67426F552B75DA5457FFDB82997CE4B77FF07E
                                        Malicious:false
                                        Preview://---------------------------------------------------------------------.//.// QR Code Generator for JavaScript.//.// Copyright (c) 2009 Kazuhiko Arase.//.// URL: http://www.d-project.com/.//.// Licensed under the MIT license:.// http://www.opensource.org/licenses/mit-license.php.//.// The word 'QR Code' is registered trademark of.// DENSO WAVE INCORPORATED.// http://www.denso-wave.com/qrcode/faqpatent-e.html.//.//---------------------------------------------------------------------..var qrcode = function() {.. //---------------------------------------------------------------------. // qrcode. //---------------------------------------------------------------------.. /**. * qrcode. * @param typeNumber 1 to 40. * @param errorCorrectionLevel 'L','M','Q','H'. */. var qrcode = function(typeNumber, errorCorrectionLevel) {.. var PAD0 = 0xEC;. var PAD1 = 0x11;.. var _typeNumber = typeNumber;. var _errorCorrectionLevel = QRErrorCorrectionLevel[errorCorrectionLevel];.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\revealer\DejaVuSansMono-Bold.ttf

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:TrueType Font data, 18 tables, 1st "FFTM", 22 names, Macintosh
                                        Category:dropped
                                        Size (bytes):331536
                                        Entropy (8bit):6.789741149323993
                                        Encrypted:false
                                        SSDEEP:6144:l2Y6/fJe6mrBD75NsETSDXE1u7I4fEZZ20eB/JGZHm3:l2YQ1mrh78XEU7nfEZZ27B6m3
                                        MD5:FB4EC87D51DDBE7C5D2F9E8F09D7E39F
                                        SHA1:FF23758A6E42BACB4C02813603E5E12AD5AEF30C
                                        SHA-256:BAADA9A5172FE20886251AFF0433FC38461912D5DAF07287E7BEE56620A8DA96
                                        SHA-512:272B8B31B21904DF61198311F6B803CF796BA26B65DE5EFA2530924F270E2FDC0AB888DA78BAE71C38DB805C5E43BE91FF81050594EB6A889E35F1C33E3C2F04
                                        Malicious:false
                                        Preview:........... FFTMo9.....,....GDEFd.W....H...tGPOS:U-........\GSUB.\..........OS/2.&...." ...Vcmapdi...."x...6cvt .I.*..8.....fpgmq49j..:4....gasp......:.....glyf...F..:....head.u.........6hhea...........$hmtx............loca..t..9...3.maxp......m.... namet4.j..m...!Bpost.K........{0prepLQ.3.................=.......}.......}...........l...................................u...v..............................................................................DFLT.&arab.0cyrl.>grek.Plao .\latn.h............................SRB ...................................4..ISM .4KSM .4LSM .4MOL .4NSM .4ROM .4SKS .4SSM .4..........mark..mark.&mark..mkmk.4.........................................$.,.4.<.D.L.T.......H.......n.................................................................".........j.............{.........j.....&.....0...........j.:...j.......|.......y.z.}.................j.Q...].j...j.h.................$.6.H.Z.l.~.............P...<...........x...................P...<...........<..........

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\revealer\LICENSE_DEJAVU.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):4816
                                        Entropy (8bit):5.077864397875037
                                        Encrypted:false
                                        SSDEEP:96:mGMeXeAJiP/hS6c4UQHDoCr49rK9eA5KPQOZQe1DcsGQHSBZoGrDebc:m6Xic6c4UQHDFr409OG+csGQHSflrj
                                        MD5:9F867DA7A73FAD2715291348E80D0763
                                        SHA1:23E8FED3E3499427EF5A80CBFF0ACA0946140493
                                        SHA-256:D75938DEC098F06F0AC3C00853065D94F020BE1C3C62EF1DC2975BA15B4D9B0E
                                        SHA-512:7510D6187016069096A33D88DB3B1144B6418362604CBEB8EE32ECA4B2BB854E9043F666078521FC9772985864AABFFFFF62680A8A49ECE89AFA33436F4DB405
                                        Malicious:false
                                        Preview:Fonts are (c) Bitstream (see below). DejaVu changes are in public domain..Glyphs imported from Arev fonts are (c) Tavmjong Bah (see below)..Bitstream Vera Fonts Copyright.------------------------------..Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved. Bitstream Vera is.a trademark of Bitstream, Inc...Permission is hereby granted, free of charge, to any person obtaining a copy.of the fonts accompanying this license ("Fonts") and associated.documentation files (the "Font Software"), to reproduce and distribute the.Font Software, including without limitation the rights to use, copy, merge,.publish, distribute, and/or sell copies of the Font Software, and to permit.persons to whom the Font Software is furnished to do so, subject to the.following conditions:..The above copyright and trademark notices and this permission notice shall.be included in all copies of one or more of the Font Software typefaces...The Font Software may be modified, altered, or added to, and in particular.t

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\revealer\SIL Open Font License.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (591)
                                        Category:dropped
                                        Size (bytes):4525
                                        Entropy (8bit):4.9314245287864855
                                        Encrypted:false
                                        SSDEEP:96:3hn52iBCxwDXFeyKnjNXiSJ2lAjaFz+PPvcyqqlQHRoh:32uC2m0SJ2lA9PPfQHRq
                                        MD5:6A445E3B469CBC2637D00771A19D63FA
                                        SHA1:015CD2F6BB6E7049412B176B2BE4C41A63A2ACE6
                                        SHA-256:D73F22C5F15342B572FEE0EF98FF7FDFA8CD3832CB37EFF44B0C6FFE3BCD96E2
                                        SHA-512:8880B24D74D4ABB14149B81597B39DA0606216AF55C9989D376050026405859807534EBEF7506A6A0AD0F6829E6741934A7C70E1FE9569E88A7F818C6C74252D
                                        Malicious:false
                                        Preview:Copyright 2010, 2012 Adobe Systems Incorporated (http://www.adobe.com/), with Reserved Font Name 'Source'. All Rights Reserved. Source is a trademark of Adobe Systems Incorporated in the United States and/or other countries...This Font Software is licensed under the SIL Open Font License, Version 1.1..This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL..-----------------------------------------------------------.SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007.-----------------------------------------------------------..PREAMBLE.The goals of the Open Font License (OFL) are to stimulate worldwide development of collaborative font projects, to support the font creation efforts of academic and linguistic communities, and to provide a free and open framework in which fonts may be shared and improved in partnership with others...The OFL allows the licensed fonts to be used, studied, modified and redistributed freely as long as they are not sold

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\revealer\SourceSansPro-Bold.otf

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:OpenType font data
                                        Category:dropped
                                        Size (bytes):235128
                                        Entropy (8bit):6.369530846550487
                                        Encrypted:false
                                        SSDEEP:6144:Ao7OQyeiLLF2uajmLJnZXP8eayy+HSSTVv/Ihp:ACOaiLLeofyeYp
                                        MD5:1A2A157BFD94B250884C09F1BD57A0BB
                                        SHA1:F4D98C36159F7CF22BA1966B94598D4E88C57C33
                                        SHA-256:9B8BD174F97413334E317BE808D14D0FF8F6EFED79A69299D84384C7E10E9312
                                        SHA-512:2381D87FE9D3C1034C73E64573E55E2B1306B48CF26439F574560E4F3FDB1B2EBC28A04A160376DFED965D8A6068DDC40357BFDE861A1A987352F3443D14BD72
                                        Malicious:false
                                        Preview:OTTO.......`BASEe.]...}....FCFF .)s4..Dl....DSIG...)..}`....GDEF..z..<.....GPOS.{....|....TGSUB...+..@h..<ZOS/2_.....P...`cmap.<.5......6^head..zu.......6hhea...U...$...$hmtx.c.....L...Xmaxp..P....H....name..h........<post...2..DL... ..........._.<......................7...m...........................7.7.m....................P........,.........X...K...X...^.2.)............`...............ADBO. . ............ .............. .....$...........p.............p.....................#.......................8.......................`.............d...........~...................................3...........M...........Y...........c...........n...........y.......................b.....................F...........(...........p...........$.f.....................4.J...........~.........2........... ...........4.........................4...........H...........^...........tCopyright 2010, 2012, 2014 Adobe Systems Incorporated (http://www.adobe.com/), with Reserved Font Name .Source..Source Sans ProBol

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\revealer\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):338
                                        Entropy (8bit):4.976373651046497
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhizUooAecRHleZekrytS4yFRlEU8oVmTq+askR1TFaHXZQGVrIr:1YvQJiz1RWkSrG3O9dR1TUHJQGV0r
                                        MD5:A46F07365C49838A07A263378E6FB8B1
                                        SHA1:3C5AE47FA123862EAF86B5A5A9F36FAEB1643D94
                                        SHA-256:1989DF20ADAB8D133B103E417CC4203029074C4E8F43FBB3530A10691907BCAD
                                        SHA-512:D2C381AE593A09B60C4C4EA123364394E6D88374771B03ED5FA580B069AC113A40D34AAA65F6D74118AC513DE2DD3A7BF636F8AFDC964648524FB3C74AAF52D0
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = _('Revealer Backup Utility').description = ''.join(["<br/>",. "<b>"+_("Do you have something to hide ?")+"</b>", '<br/>', '<br/>',. _("This plug-in allows you to create a visually encrypted backup of your wallet seeds, or of custom alphanumeric secrets."), '<br/>']).available_for = ['qt']...

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\revealer\hmac_drbg.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1826
                                        Entropy (8bit):5.120325552455995
                                        Encrypted:false
                                        SSDEEP:48:raJHlxE35QHOs5exm3ogF5Ie6mdTCG+zVwJu:eupQHTo86ZGu
                                        MD5:D5013CD088CA262AED345AD253C661CC
                                        SHA1:B6A887E25EC2E7AD91D095B0FA71E360FEDDC676
                                        SHA-256:EBADC22762FCC44BD99903D91380C7E39B7791EF0FC848819D9B649BFC43FD0F
                                        SHA-512:8CD0D87F2A3D79688E2037D78218C25B6A7D9D8B12AA6BF853199C28A52B65200E4CDE6F0730F96DA2497D2E183CF88A630E5EB22D0059165E48F4B9ACDBF9E9
                                        Malicious:false
                                        Preview:'''.Copyright (c) 2014 David Lazar <lazard@mit.edu>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\revealer\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):38721
                                        Entropy (8bit):4.634066084919751
                                        Encrypted:false
                                        SSDEEP:384:J957z2ZJuFgOOklFHQWX00yZ9oa9QW/JCVahuknRRn4NYnokuMhNZ7bZMeHq8EzR:JjRnwzLoa9QW/JCGl5bt5C3
                                        MD5:33235D89C19356BE0118D4604254A0BE
                                        SHA1:5CC071915FF2BDC4EC64E88EB47341574C709BDF
                                        SHA-256:169E93438B45725D693012D071863B6C78B880EC48DA2052A4CC7B8875B00483
                                        SHA-512:EA574970B5AD07F913CBF5BE9BE29ABFBDD5E4C72CBFA60CA2B71854E107B7536DA3A04B27CD66B4022201943C6F94B5740B636D78CB56D9320E56A27EE083C9
                                        Malicious:false
                                        Preview:'''..Revealer.Do you have something to hide?.Secret backup plug-in for the electrum wallet...Copyright:. 2017 Tiago Romagnani Silveira. 2023 Soren Stoutner <soren@debian.org>..Distributed under the MIT software license, see the accompanying.file LICENCE or http://www.opensource.org/licenses/mit-license.php..'''..import os.import random.import traceback.from decimal import Decimal.from functools import partial.import sys..import qrcode.from PyQt5.QtPrintSupport import QPrinter.from PyQt5.QtCore import Qt, QRectF, QRect, QSizeF, QUrl, QPoint, QSize.from PyQt5.QtGui import (QPixmap, QImage, QBitmap, QPainter, QFontDatabase, QPen, QFont,. QColor, QDesktopServices, qRgba, QPainterPath).from PyQt5.QtWidgets import (QGridLayout, QVBoxLayout, QHBoxLayout, QLabel,. QPushButton, QLineEdit)..from electrum.plugin import hook.from electrum.i18n import _.from electrum.util import make_dir, InvalidPassword, UserCancelled.from electrum.gui.qt.u

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\revealer\revealer.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3559
                                        Entropy (8bit):4.545874647248047
                                        Encrypted:false
                                        SSDEEP:96:a7iFbsTt5NqX0lNx0IYqWGxc10M6ZeeneBbriKmoY/f8SeDh:Iiy5400zkeenQuveN
                                        MD5:2B64D9140F5EFAE125B249C28EC2BBBA
                                        SHA1:AB7A1EB80DC0586AA79F5EAB4B77B9ACD8A0D275
                                        SHA-256:49D230C7A399DBC2067E567E9C7B7D9AF50DE99CF3211A6350700AF4E17ED007
                                        SHA-512:A16ED1DE561ACCF8574870022851AADB99C0CD8C442D6323814AE2C27466D00BB38C5D1FB33595C071D68E91EA282DE30EE61352D7868A546C89EC731A21529E
                                        Malicious:false
                                        Preview:import random.import os.from hashlib import sha256.from typing import NamedTuple, Optional, Dict, Tuple..from electrum.plugin import BasePlugin.from electrum.util import to_bytes, bfh..from .hmac_drbg import DRBG...class VersionedSeed(NamedTuple):. version: str. seed: str. checksum: str.. def get_ui_string_version_plus_seed(self):. version, seed = self.version, self.seed. assert isinstance(version, str) and len(version) == 1, version. assert isinstance(seed, str) and len(seed) >= 32. ret = version + seed. ret = ret.upper(). return ' '.join(ret[i : i+4] for i in range(0, len(ret), 4))...class RevealerPlugin(BasePlugin):.. LATEST_VERSION = '1'. KNOWN_VERSIONS = ('0', '1'). assert LATEST_VERSION in KNOWN_VERSIONS.. SIZE = (159, 97).. def __init__(self, parent, config, name):. BasePlugin.__init__(self, parent, config, name).. @classmethod. def code_hashid(cls, txt: str) -> str:. txt = txt.lower().

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\safe_t\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):299
                                        Entropy (8bit):4.87862334366989
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhsrMv6IFQVR1OMCHZ8iWUl0MACwKNQo6KC7V44WGVrIeCM7iv:1YvQJAS6DnOx58W0t2C5uGV0dM+v
                                        MD5:343121E1057A6FC48EC3C10A58D773EC
                                        SHA1:13B5D7FD4B839D74221A251647EB2AE9EAD318E7
                                        SHA-256:DD7FFFF8D2DD5E073CA708875E3DB16625AD5ECA0C9D3E1702A714384C6BF096
                                        SHA-512:7F220F35EFB066FA5DBE94180785F14F53B024774030E86A186249D3CB39CB98BEFB90C218A144F2771B5F4F0C6ADCF3CB4DC52D2FFD023C356CB0EA0E3C465C
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Safe-T mini Wallet'.description = _('Provides support for Safe-T mini hardware wallet').requires = [('safetlib','github.com/archos-safe-t/python-safet')].registers_keystore = ('hardware', 'safe_t', _("Safe-T mini wallet")).available_for = ['qt', 'cmdline']..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\safe_t\client.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):437
                                        Entropy (8bit):4.559059320330288
                                        Encrypted:false
                                        SSDEEP:12:1xRPRXZI6FDd0zjDdoI90x1AF9AVnIyAVlDA6Jq1Vy:1x3/CzvuAF9ArAPA6Jqi
                                        MD5:5944759562DC7E18859E3C5B7A21BB40
                                        SHA1:A54A0F9614D768D02F4E671653988286725CE330
                                        SHA-256:BA33F2F015236FBBCD6D41F9B8E4E3CAB69464F119C53D7EB0D9B812AB3B189B
                                        SHA-512:CFA7ECF995DDEB7B0DAC502DF224938463DD3AD53D47212366EFABAF110E06419069839168F5E95EFB5388F5040A49B71C147AD9496C4C20902E946BBC19902A
                                        Malicious:false
                                        Preview:from safetlib.client import proto, BaseClient, ProtocolMixin.from .clientbase import SafeTClientBase..class SafeTClient(SafeTClientBase, ProtocolMixin, BaseClient):. def __init__(self, transport, handler, plugin):. BaseClient.__init__(self, transport=transport). ProtocolMixin.__init__(self, transport=transport). SafeTClientBase.__init__(self, handler, plugin, proto)...SafeTClientBase.wrap_methods(SafeTClient).

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\safe_t\clientbase.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):10178
                                        Entropy (8bit):4.5253358235227354
                                        Encrypted:false
                                        SSDEEP:192:C488tMUvff5J11Rku28Alve/h2B0oyCGOAiwvt:28tjve/+2WoyD5b
                                        MD5:8D278A0B2B3B0C665BD311F17878A3F3
                                        SHA1:D6BA80C0E077B09BD00713578A3FABCA777C035E
                                        SHA-256:F79102D2776453454990CC4A28BD1A8ED69B54B0AD783F0024464AC21E659A30
                                        SHA-512:05D59F95D4A91DAE2922F8A460F68E7686F95C6156B8F55F407B083D141C7CAE847FBF7FF0BEA2EF3E74A0EB7FE3A3DD2575C2286BA61485DD6E752893AC75A6
                                        Malicious:false
                                        Preview:import time.from struct import pack.from typing import Optional..from electrum import ecc.from electrum.i18n import _.from electrum.util import UserCancelled.from electrum.keystore import bip39_normalize_passphrase.from electrum.bip32 import BIP32Node, convert_bip32_strpath_to_intpath.from electrum.logging import Logger.from electrum.plugin import runs_in_hwd_thread.from electrum.plugins.hw_wallet.plugin import HardwareClientBase, HardwareHandlerBase...class GuiMixin(object):. # Requires: self.proto, self.device. handler: Optional[HardwareHandlerBase].. # ref: https://github.com/trezor/trezor-common/blob/44dfb07cfaafffada4b2ce0d15ba1d90d17cf35e/protob/types.proto#L89. messages = {. 3: _("Confirm the transaction output on your {} device"),. 4: _("Confirm internal entropy on your {} device to begin"),. 5: _("Write down the seed word shown on your {}"),. 6: _("Confirm on your {} that you want to wipe it clean"),. 7: _("Confirm on your {} devi

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\safe_t\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):396
                                        Entropy (8bit):4.478728505749281
                                        Encrypted:false
                                        SSDEEP:12:1KM82qFD5+85jEI2Hvsb/aCTATSvehahBNA099a/:1/KcoE3Hvsb/aC9sahfA0y/
                                        MD5:86DAE1F1ED0C3C4188E9A432E0E86B5F
                                        SHA1:B6157EA178F5F84201EF1F299DA9473CB21E4C0F
                                        SHA-256:9CFBA2C4F909B87CBD9493F72FFFF4A2D8B3870759B77D84B02DAB2ABF761F57
                                        SHA-512:55DBF9C52BFD4A2EDC40705FEB5F8CBEBDB92449396C772EF24AD5BDAC90C2F4CFA77CDC0CAE71DBCAA12EC7DE56C8E9ABFBFCF458F1295947775512AC99A8D9
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from .safe_t import SafeTPlugin.from ..hw_wallet import CmdLineHandler..class Plugin(SafeTPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\safe_t\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):26464
                                        Entropy (8bit):4.609627644960407
                                        Encrypted:false
                                        SSDEEP:384:euq1cnVcNjxHyTWYO0ZF2lvVSjlmmvi4yL6OaoJa4z1MukFviY17rBF:riyTrV2lvVSjlmmvi4yL6OaoJa4z1+Rz
                                        MD5:7830105DEF4B9F5F05533A620B834FD5
                                        SHA1:32D2BC511319806D569EEC399E1ACA1372715525
                                        SHA-256:249B34862EA38C1E24D5A0B39F29F8211FF49D8448B32BF71C389871B8DD16D7
                                        SHA-512:40C2F090A085C201807AF1A6360FE476B8BF4CAC00270BB948A2FC9201309989810196DF4E56C7AC320FD9E06AADC3FBE7C9DA335094419CBE61764755B5FD1F
                                        Malicious:false
                                        Preview:import threading.from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt, pyqtSignal, QRegExp.from PyQt5.QtGui import QRegExpValidator.from PyQt5.QtWidgets import (QVBoxLayout, QLabel, QGridLayout, QPushButton,. QHBoxLayout, QButtonGroup, QGroupBox,. QTextEdit, QLineEdit, QRadioButton, QCheckBox, QWidget,. QMessageBox, QFileDialog, QSlider, QTabWidget)..from electrum.gui.qt.util import (WindowModalDialog, WWLabel, Buttons, CancelButton,. OkButton, CloseButton, getOpenFileName, ChoiceWidget).from electrum.i18n import _.from electrum.plugin import hook.from electrum.logging import Logger..from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available.from .safe_t import SafeTPlugin, TIM_NEW, TIM_RECOVER, TIM_MNEMONIC, TIM_PRIVKEY..from electrum.gui.qt.wizard.wallet import WCScriptAn

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\safe_t\safe_t.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):17484
                                        Entropy (8bit):4.4774263925224265
                                        Encrypted:false
                                        SSDEEP:192:4vInEP87zX3kMaWn0Erq7ZaQUdmADh3h4qb1vlzoVODrwTcaCkjmc3Y5FCKBJ:OuEE7zXab5A11X4TRpS465
                                        MD5:9777E76D4BB43B3CBFEA37E17AA027D3
                                        SHA1:AFB13514441386BA154C625E5C3DB106F54FFC3B
                                        SHA-256:0D1926DBF570BBEDA5FB036EFA1E0C7415AA292AA196E2511AA85563CCF39A72
                                        SHA-512:D891333E8401EBD861C63398763936E90A59057DB8E27373766B4952F116518B058EB087EA8E11BE5B57E3E5AD6524E1C6D3421EA33B81BA2FAA759CDA798C44
                                        Malicious:false
                                        Preview:from typing import Optional, TYPE_CHECKING, Sequence..from electrum.util import UserFacingException.from electrum.bip32 import BIP32Node.from electrum import descriptor.from electrum import constants.from electrum.i18n import _.from electrum.plugin import Device, runs_in_hwd_thread.from electrum.transaction import Transaction, PartialTransaction, PartialTxInput, Sighash.from electrum.keystore import Hardware_KeyStore..from ..hw_wallet import HW_PluginBase.from ..hw_wallet.plugin import is_any_tx_output_on_change_branch, trezor_validate_op_return_output_and_get_data..if TYPE_CHECKING:. from .client import SafeTClient. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard..# Safe-T mini initialization methods.TIM_NEW, TIM_RECOVER, TIM_MNEMONIC, TIM_PRIVKEY = range(0, 4)...class SafeTKeyStore(Hardware_KeyStore):. hw_type = 'safe_t'. device = 'Safe-T mini'.. plugin: 'SafeTPlugin'.. def decrypt_message(self, sequence, message, password):.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\safe_t\transport.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3566
                                        Entropy (8bit):4.057092640627583
                                        Encrypted:false
                                        SSDEEP:48:AQ2A08bYgHtJsEQFqHmEKdj1mcCFseqH0K01MCJz2w2H6z0r:9/ZbHYpqHjKR1TCFseqH0K01MCkJ20r
                                        MD5:8D74F45856984B897234324DDDDA24B1
                                        SHA1:99E08A642EEB29C436915AE0D2D1CA3B54FC45E8
                                        SHA-256:11805CAB34CFA8D9E5649660F8EDA874DA3B838D9A798FFF73AF36A99B6C5942
                                        SHA-512:5896102EE4CF79061E9F5FEEA99AF9CABB572ED43CC99D961D1FA16B085E551AF2CD61062C316605A9777032CB7961B42C61BC35B8F515BC880594DB86939441
                                        Malicious:false
                                        Preview:from electrum.logging import get_logger..._logger = get_logger(__name__)...class SafeTTransport:.. @staticmethod. def all_transports():. """Reimplemented safetlib.transport.all_transports so that we can. enable/disable specific transports.. """. # NOTE: the bridge and UDP transports are disabled as they are using. # the same ports as trezor. try:. # only to detect safetlib version. from safetlib.transport import all_transports. except ImportError:. # old safetlib. compat for safetlib < 0.9.2. transports = []. #try:. # from safetlib.transport_bridge import BridgeTransport. # transports.append(BridgeTransport). #except BaseException:. # pass. try:. from safetlib.transport_hid import HidTransport. transports.append(HidTransport). except BaseException:. pass.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\swapserver\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):281
                                        Entropy (8bit):4.673123753641383
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rh7ZFI3asnkDeh1Ebt+W/ir0aOvUTiVrmin:1YvQJ10aTDei+GxafOVDn
                                        MD5:8B3821DB8DBE1616231CD84E32E673C0
                                        SHA1:9813ED26316C86D4CBE5BC63E59B86CF43DDA484
                                        SHA-256:8D618898B3BD6026EA29F834AFE110C51CABF0AA33ADE67B100BC1C10035FF10
                                        SHA-512:678E5EB82260EAFE9F999A64C10FC52F1D7278B7D971652CCD0A88A48E41BBF5EEEB32AD3B3F14CE556027550F3C1E3890C6A43263BA18B12AEBBBD09B923CB2
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = _('SwapServer').description = """.Submarine swap server for an Electrum daemon...Example setup:.. electrum -o setconfig use_swapserver True. electrum -o setconfig swapserver_port 5455. electrum daemon -v.."""..available_for = ['cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\swapserver\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1256
                                        Entropy (8bit):5.155823600669133
                                        Encrypted:false
                                        SSDEEP:24:Uo29k4JHWWV0yPP3VtkHe1oai9QHlsUjH8Ok46+d5Eo3DqeFhiV:Ul9tJdVlPvLTmawQHlsyHIO5d3D1Fq
                                        MD5:6EC9B7A969DA6EB7CEA614180200F666
                                        SHA1:41EC25724D7BD518FB93773A334D819A0758B8C3
                                        SHA-256:38316F0A117F3FD4E6BC00F1FE17A409A2CC3CBABDD729EBDA07A979E907FBED
                                        SHA-512:657D6A40C968228B3A73D318E6DF99AF41F2E7E42A8E0B93103EC54097A543549EBDC14699FF62A51273678301AEBEB4644947063B4973415E26720DFEB06B13
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2023 The Electrum Developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LI

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\swapserver\server.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):5604
                                        Entropy (8bit):4.247659402001842
                                        Encrypted:false
                                        SSDEEP:96:gtk7UOhk7dkqudkq+gdkqaKhQ3R81jn7Wn7CyiSCyFOFRL7sKjobNIONKtAAb:OOK7m3m6mghXfsCyiSCyFAZ1b
                                        MD5:F712135399E696A75ACDEE2DFC669878
                                        SHA1:94A94A5AFEBF491F29736439136941AFBAE49E5C
                                        SHA-256:FB9E1A4DAD21967653FFFC3AB1D79691ACCC5BED52F11CF2F2973373C29EDF4F
                                        SHA-512:551089C8229B5C898E9417291AC314B8F1066431B0B0BB5980B0B487D7569DB83635376B9E88C6A5B02382BA53DBD363077C162A4C763032C340BAE63219A648
                                        Malicious:false
                                        Preview:import os.import asyncio.from collections import defaultdict.from typing import TYPE_CHECKING..from aiohttp import web..from electrum.util import log_exceptions, ignore_exceptions.from electrum.logging import Logger.from electrum.util import EventListener.from electrum.lnaddr import lndecode..if TYPE_CHECKING:. from electrum.simple_config import SimpleConfig. from electrum.wallet import Abstract_Wallet...class SwapServer(Logger, EventListener):. """. public API:. - getpairs. - createswap. """.. WWW_DIR = os.path.join(os.path.dirname(__file__), 'www').. def __init__(self, config: 'SimpleConfig', wallet: 'Abstract_Wallet'):. Logger.__init__(self). self.config = config. self.wallet = wallet. self.sm = self.wallet.lnworker.swap_manager. self.port = self.config.SWAPSERVER_PORT. self.register_callbacks() # eventlistener.. self.pending = defaultdict(asyncio.Event). self.pending_msg = {}.. @ignore_exceptions.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\swapserver\swapserver.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):2173
                                        Entropy (8bit):5.070264365552861
                                        Encrypted:false
                                        SSDEEP:48:Ul9tJdVlPvLTmawQHlsyHIO5d3D1Fj++G4O83VyK:SzPjdwQHzJDS+G4l
                                        MD5:66DDC612C6AC03F03BF12047B2C01AEE
                                        SHA1:56F557E5F66F0ED5E3B697DABF3D5F550FA9E807
                                        SHA-256:7F9C7EC1D215BB53BF2654550FF7445F22854B6AAF95562C23112B2B92469BD9
                                        SHA-512:69D50ADCEC08B1B9A26793E910E174B08BA30C4304705F1B1BF88409E3E26670F4CD6D9EA1F76FC13BEE3D59F6A7E6348E22C65C6A91D6BC258BC5683F07B612
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2023 The Electrum Developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LI

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trezor\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):272
                                        Entropy (8bit):4.786008146303495
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhyQfgv6IF3KaOIBZf+LMpQwKNQo6Kw6g+WGVrIeCM7iv:1YvQJyKe66OIBZ1ph2wfGV0dM+v
                                        MD5:E058B599B9BB73EDF3E28A02C437BE26
                                        SHA1:831B4631971268A66B515A093B67D2D1AB84A01D
                                        SHA-256:FD72B5833DC8DBCB9B96B5432AE494FBDB296604CBAF72D0F4B86B926C61259D
                                        SHA-512:C6E2752963378AEB885F252DE9D1744769484EFCE08666B931ACEF5ECBEFA12A67BB2BCBFD0A58FC2725AF186E99C0A9A25E7C79A2045AF12E376263A5D82F00
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Trezor Wallet'.description = _('Provides support for Trezor hardware wallet').requires = [('trezorlib','pypi.org/project/trezor/')].registers_keystore = ('hardware', 'trezor', _("Trezor wallet")).available_for = ['qt', 'cmdline']..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trezor\clientbase.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):12888
                                        Entropy (8bit):4.509681343167102
                                        Encrypted:false
                                        SSDEEP:192:sEKDuv6c1tyNQ8doIh8lI0KpNpeCaO9Z51mNl05BZWhz:xv6c1tyNBdo7dKrpepuZ51wAWhz
                                        MD5:DAA68E004400994AAA6965D32DBA53FE
                                        SHA1:78D133C1D8D32B0F917D3991F3F9E9F7FC606278
                                        SHA-256:84A6A5D716724C320B0D1ED08AD1A767B452533D1D7E66FFFA336585DAA506E1
                                        SHA-512:E0C75CAE960673C3939C0887AF8837EA0649A35E274200FF3E3820A19DC900D39A763BF5F2E79EF80BA8C8A3054FE855DC887CD91037C459D2B91904D8A91D23
                                        Malicious:false
                                        Preview:import time.from struct import pack..from electrum import ecc.from electrum.i18n import _.from electrum.util import UserCancelled, UserFacingException.from electrum.keystore import bip39_normalize_passphrase.from electrum.bip32 import BIP32Node, convert_bip32_strpath_to_intpath as parse_path.from electrum.logging import Logger.from electrum.plugin import runs_in_hwd_thread.from electrum.plugins.hw_wallet.plugin import OutdatedHwFirmwareException, HardwareClientBase..from trezorlib.client import TrezorClient, PASSPHRASE_ON_DEVICE.from trezorlib.exceptions import TrezorFailure, Cancelled, OutdatedFirmwareError.from trezorlib.messages import WordRequestType, FailureType, RecoveryDeviceType, ButtonRequestType.import trezorlib.btc.import trezorlib.device..MESSAGES = {. ButtonRequestType.ConfirmOutput:. _("Confirm the transaction output on your {} device"),. ButtonRequestType.ResetDevice:. _("Complete the initialization process on your {} device"),. ButtonRequestType.C

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trezor\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):909
                                        Entropy (8bit):4.652809271805978
                                        Encrypted:false
                                        SSDEEP:24:1/emAOAtpVBA8nEBcfP466hHvsb/aC9sahfA0y/:demAFdr01vwaCVZG
                                        MD5:5E0A672C8DF5259377040713B13891AB
                                        SHA1:6032B7262AC9DF8A3FAC7773B9D4A469A6169D14
                                        SHA-256:E411C2605E91F0490C74CCBA9CDE8E5A9F798B8561F0F7D55CCD8DAC610AF8A2
                                        SHA-512:5A9D028D60134415BDC97E27DEF8D4C570B8BC1DF1845552692FCA596F41FDC1400F488EB2C6BC969EE6316BA6057D303B001A92D30087BDDA24D91075BDBD91
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from electrum.i18n import _.from electrum.util import print_stderr.from .trezor import TrezorPlugin, PASSPHRASE_ON_DEVICE.from ..hw_wallet import CmdLineHandler..class TrezorCmdLineHandler(CmdLineHandler):. def __init__(self):. self.passphrase_on_device = False. super().__init__().. def get_passphrase(self, msg, confirm):. import getpass. print_stderr(msg). if self.passphrase_on_device and self.yes_no_question(_('Enter passphrase on device?')):. return PASSPHRASE_ON_DEVICE. else:. return getpass.getpass('')..class Plugin(TrezorPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trezor\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):37455
                                        Entropy (8bit):4.635419853213909
                                        Encrypted:false
                                        SSDEEP:768:3GRkbbfsyTrV2lvVSjlmmvi4yL6OaoJa4z1jz:o6bkyTrV2l9SjlmSi4yL6Oaka4z13
                                        MD5:B228481C96665FD645EC7A2F79250880
                                        SHA1:CD44B61E9766D041AEEC671ED05B88BA328B3BC6
                                        SHA-256:EDD0ACEABC10CC40BEC9EA22C6F9CFF1F23259F5D6D6E7A8F10BD835FA6EC119
                                        SHA-512:25A2F35ABEF59AD0674984B67F9172B4709CC1F4355218738D3C912EC2F19CD0033431B369AD61FE31767D3AD757C8B427DF3B938889304E2966F55B109940A6
                                        Malicious:false
                                        Preview:from functools import partial.import threading.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt, QEventLoop, pyqtSignal.from PyQt5.QtWidgets import (QVBoxLayout, QLabel, QGridLayout, QPushButton,. QHBoxLayout, QButtonGroup, QGroupBox, QDialog,. QLineEdit, QRadioButton, QCheckBox, QWidget,. QMessageBox, QSlider, QTabWidget)..from electrum.i18n import _.from electrum.logging import Logger.from electrum.plugin import hook.from electrum.keystore import ScriptTypeNotSupported..from electrum.plugins.hw_wallet.qt import QtHandlerBase, QtPluginBase.from electrum.plugins.hw_wallet.plugin import only_hook_if_libraries_available, OutdatedHwFirmwareException..from electrum.gui.qt.util import (WindowModalDialog, WWLabel, Buttons, CancelButton,. OkButton, CloseButton, PasswordLineEdit, getOpenFileName, ChoiceWidget).from electrum.gui.qt.wizard.wallet import WCScriptAndDer

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trezor\trezor.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):22315
                                        Entropy (8bit):4.493298888774816
                                        Encrypted:false
                                        SSDEEP:384:2OWNZzZPTmr861/+j6p8qqZ+d1wSWInNyP:2O+d7mrRx+Op8eGINg
                                        MD5:E2F74B1D941CA0077079B86A95674CBD
                                        SHA1:3A8F0D9A9083188928BDBEDBF95F562DDBD018A5
                                        SHA-256:52AEFB59DA8D95A7A8D79BF5BC458888B4168847AD7076B8CA571CDD63D56EAE
                                        SHA-512:AC2C6FE9A994655406B825C7E5B8A60C1A6133981C3E8681D3358985ED06BC21C90E99C7C5681D921E87C9E1EE5A4E336E0664C216983E9ECE80B3C52D58AF89
                                        Malicious:false
                                        Preview:from typing import NamedTuple, Any, Optional, TYPE_CHECKING, Sequence..from electrum.util import bfh, UserCancelled, UserFacingException.from electrum.bip32 import BIP32Node.from electrum import descriptor.from electrum import constants.from electrum.i18n import _.from electrum.plugin import Device, runs_in_hwd_thread.from electrum.transaction import Transaction, PartialTransaction, PartialTxInput, Sighash.from electrum.keystore import Hardware_KeyStore.from electrum.logging import get_logger..from electrum.plugins.hw_wallet import HW_PluginBase.from electrum.plugins.hw_wallet.plugin import is_any_tx_output_on_change_branch, \. trezor_validate_op_return_output_and_get_data, LibraryFoundButUnusable, OutdatedHwFirmwareException..if TYPE_CHECKING:. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard.._logger = get_logger(__name__)...try:. import trezorlib. import trezorlib.transport. from trezorlib.transport.bridge import BridgeTransport,

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trustedcoin\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):427
                                        Entropy (8bit):4.980850437894484
                                        Encrypted:false
                                        SSDEEP:12:1YvQJjvMLuk9v+HWTqgKYtKYVnACw/V0dM+:1YIj0Rv+H6qgKAKkw/p+
                                        MD5:E66C24ACF8F44F23398D7FDFFFE3649C
                                        SHA1:0881088EEC342763265462BDC9CA2814C49F49ED
                                        SHA-256:AD34B9362ABE25CB8D30FFF4381557BF26F714011306A3B6A7A9CAA991024DAF
                                        SHA-512:A3BA8BF68BB218A4BD5D557DD57F483E737337CF244BBE8D655F0580DCC67E13E20C6C5C67C84C1010DD06EA4D9FB673477A699243B8D64B57DC1A81365D9831
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = _('Two Factor Authentication').description = ''.join([. _("This plugin adds two-factor authentication to your wallet."), '<br/>',. _("For more information, visit"),. " <a href=\"https://api.trustedcoin.com/#/electrum-help\">https://api.trustedcoin.com/#/electrum-help</a>".]).requires_wallet_type = ['2fa'].registers_wallet_type = '2fa'.available_for = ['qt', 'cmdline', 'qml'].

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trustedcoin\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1894
                                        Entropy (8bit):5.069934641699078
                                        Encrypted:false
                                        SSDEEP:48:UMotJdVlPvLTmawQHlsyHIO5d3D1FLmoJOaCDkfaIiznYiNa0i3S:czPjdwQHzJDTmANSjznTQXi
                                        MD5:3CC359BD71D0D159C1F9B786FAF0A059
                                        SHA1:7A90F59E2BB4BF9EA234F04EA9338F0178087058
                                        SHA-256:D569F1D5F6003ADA5CEFB7B32F0B319DF18F66018DC9058F43C28E0005BDC585
                                        SHA-512:556EC5B104C8EF1D61F065DA9DC57077172F9720C78133688913A4CAC0F5DF1FF3355282103D914C31B1B111F5CADA9B1D3FBE5AF94FDE04C647C7B3B945E8C3
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2015 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trustedcoin\common_qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):9525
                                        Entropy (8bit):4.463728912000741
                                        Encrypted:false
                                        SSDEEP:192:tALDsa+8Q9ClNoMQhhnNiDliJvBfCfMCsvqCQoC2TCsUCrICgcCdC+BniCsvfCsK:tZKQTRvEfDsv5Qf2Osbr/gzAqhsvqsgZ
                                        MD5:94C7B1918CF6851A6088A9C1D4953A55
                                        SHA1:086F14E5E860DCE219C26B5E8B938EDCF022E7D9
                                        SHA-256:3D6F3BF6DFCAB65DB6AAD597C405FF4A5D6AA5B2A4608F810959A01ED976636C
                                        SHA-512:ABA2EE8E8E6D5AF5655EC4139E669EDF0C2EC30901B14F2D3769B8D2456BF3B9D2D53C89F39B6838DC0BBBCC46D5817F50C2D22900B3FC5D2396E029A3CD9188
                                        Malicious:false
                                        Preview:import threading.import socket.import base64.import sys.from typing import TYPE_CHECKING..from electrum.gui.common_qt import get_qt_major_version..if (qt_ver := get_qt_major_version()) == 5:. from PyQt5.QtCore import pyqtSignal, pyqtProperty, pyqtSlot.elif qt_ver == 6:. from PyQt6.QtCore import pyqtSignal, pyqtProperty, pyqtSlot.else:. raise Exception(f"unexpected {qt_ver=}")..from electrum.i18n import _.from electrum.bip32 import BIP32Node..from .trustedcoin import (server, ErrorConnectingServer, MOBILE_DISCLAIMER, TrustedCoinException).from electrum.gui.common_qt.plugins import PluginQObject..if TYPE_CHECKING:. from electrum.wizard import NewWalletWizard...class TrustedcoinPluginQObject(PluginQObject):. canSignWithoutServerChanged = pyqtSignal(). termsAndConditionsRetrieved = pyqtSignal([str], arguments=['message']). termsAndConditionsError = pyqtSignal([str], arguments=['message']). otpError = pyqtSignal([str], arguments=['message']). otpSuccess = pyqtSign

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trustedcoin\qml.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):4438
                                        Entropy (8bit):4.542663800780709
                                        Encrypted:false
                                        SSDEEP:96:FmaHbRSMlYf6iEojAToJ1CaQSreVa6rIye8Rbirb0EVk5qw:FQMqf6zodfRyk3+
                                        MD5:71B16A8DAA21E4160EB6652E16777949
                                        SHA1:CBA87F51104DED30AADB589CDA8DEB51A673E568
                                        SHA-256:B8D20D0B69EAE96C4FF3657A3C08BA24DE4D708EF232617631BAE1D0A71E818D
                                        SHA-512:E9EF841CA716C50D0FA42FE3214ABC0E157849CF06DCB57B96439FBD0BA15E0E95BDB317AF0EF5D4544C19808A02AD179189E723D1B294287CD8377E6B9CDFDD
                                        Malicious:false
                                        Preview:from typing import TYPE_CHECKING..from electrum.i18n import _.from electrum.plugin import hook.from electrum.util import UserFacingException..from electrum.gui.qml.qewallet import QEWallet.from .common_qt import TrustedcoinPluginQObject..from .trustedcoin import TrustedCoinPlugin, TrustedCoinException..if TYPE_CHECKING:. from electrum.gui.qml import ElectrumQmlApplication. from electrum.wallet import Abstract_Wallet. from electrum.wizard import NewWalletWizard...class Plugin(TrustedCoinPlugin):. def __init__(self, *args):. super().__init__(*args).. @hook. def load_wallet(self, wallet: 'Abstract_Wallet'):. if not isinstance(wallet, self.wallet_class):. return. self.logger.debug(f'plugin enabled for wallet "{str(wallet)}"'). if wallet.can_sign_without_server():. self.so._canSignWithoutServer = True. self.so.canSignWithoutServerChanged.emit().. msg = ' '.join([. _('This wallet was rest

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trustedcoin\qml\ChooseSeed.qml

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):987
                                        Entropy (8bit):4.377160104670154
                                        Encrypted:false
                                        SSDEEP:24:I60KU0cWm7HWgAsDXQHsXAEWBsUNf0yTEWBsUG4b:I60KU3W385wEyT5b
                                        MD5:1538526A6F8C2B5BBCF41D29176E0033
                                        SHA1:5BF872444F9AC66B60F78010211E73260D4C7AAB
                                        SHA-256:CAC28FA0E5AB8E92C0D39EE6347A483BF0CC729CC7F4128FF3A9B9E7787A57A0
                                        SHA-512:52EB06472FF6D64A2F9434EBDB3A6F531C0B79EE22F06DA1B2F35D461092B0DD9FE95977FC8A9440CB0867969CF5E603DBE2AE7EFE4DCCA731942661935EF304
                                        Malicious:false
                                        Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import "../../../gui/qml/components/wizard"..WizardComponent {. valid: keystoregroup.checkedButton !== null.. onAccept: {. wizard_data['keystore_type'] = keystoregroup.checkedButton.keystoretype. }.. ButtonGroup {. id: keystoregroup. }.. ColumnLayout {. width: parent.width. Label {. text: qsTr('Do you want to create a new seed, or restore a wallet using an existing seed?'). Layout.preferredWidth: parent.width. wrapMode: Text.Wrap. }. RadioButton {. ButtonGroup.group: keystoregroup. property string keystoretype: 'createseed'. checked: true. text: qsTr('Create a new seed'). }. RadioButton {. ButtonGroup.group: keystoregroup. property string keystoretype: 'haveseed'. text: qsTr('I already have a seed'). }. }.}..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trustedcoin\qml\Disclaimer.qml

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):691
                                        Entropy (8bit):4.488786222118965
                                        Encrypted:false
                                        SSDEEP:12:IZ3g0KUVwtQdcRIBgoNn8XvWqEZdbUNAkQfavJWpMZewBC3:I60KUOQdcWm9XOqEHbUNAkOUk
                                        MD5:7BBE01289D5EF8E1BFD0A228791F9F4A
                                        SHA1:16B766B60574DDCC8F240911221833D580850DC4
                                        SHA-256:8BFE67D032D999F0A189A2D40D263D4805752DD19D802520CB593C2103492B0F
                                        SHA-512:6F53E111053BA0B8FE43B9B6776C57F1D9D30388A496404214B69FCE6FE556F66FA35C7F6FF9453E3E0862C64525A0CE2B1E971DE90370C90AE86F2C285664BE
                                        Malicious:false
                                        Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import org.electrum 1.0..import "../../../gui/qml/components/wizard"..WizardComponent {. valid: true.. property QtObject plugin.. ColumnLayout {. width: parent.width.. Image {. Layout.alignment: Qt.AlignHCenter. Layout.bottomMargin: constants.paddingLarge. source: '../../../gui/icons/trustedcoin-wizard.png'. }.. Label {. Layout.fillWidth: true. text: plugin ? plugin.disclaimer : ''. wrapMode: Text.Wrap. }. }.. Component.onCompleted: {. plugin = AppController.plugin('trustedcoin'). }.}.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trustedcoin\qml\KeepDisable.qml

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):869
                                        Entropy (8bit):4.480847222564419
                                        Encrypted:false
                                        SSDEEP:12:IZ3g0KU0cRIBgPnvMfsZEgAUoXjWd/qEWQleUcZ708pD8EWQleUcwKmkL:I60KU0cWm8BgAxUCEWBT70bEWBLL
                                        MD5:4985A1EF1BE8632AC940FE9870EE1B8C
                                        SHA1:124107285D54EFD05F52C3FF8218887EA9782B79
                                        SHA-256:D7EBDE437B8C5C7248F976F52DC7B3623BD37E8A8B0EEBF8DAA77FB519E29301
                                        SHA-512:F313573375CE56022E6435D77EE84F3B15CCB39BD9DC0EF2C11CA049748F914E97686FED8E30C6093151E2767943B4960015A5F44B338D0EB478DA3338103570
                                        Malicious:false
                                        Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import "../../../gui/qml/components/wizard"..WizardComponent {. valid: keepordisablegroup.checkedButton.. function apply() {. wizard_data['trustedcoin_keepordisable'] = keepordisablegroup.checkedButton.keepordisable. }.. ButtonGroup {. id: keepordisablegroup. onCheckedButtonChanged: checkIsLast(). }.. ColumnLayout {. Label {. text: qsTr('Restore 2FA wallet'). }. RadioButton {. ButtonGroup.group: keepordisablegroup. property string keepordisable: 'keep'. checked: true. text: qsTr('Keep'). }. RadioButton {. ButtonGroup.group: keepordisablegroup. property string keepordisable: 'disable'. text: qsTr('Disable'). }. }.}.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trustedcoin\qml\ShowConfirmOTP.qml

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):4228
                                        Entropy (8bit):4.394171154362271
                                        Encrypted:false
                                        SSDEEP:96:L0S5y4rPp1r+0Tb5r+heUrZ80v4KmLUYCU8SaoP9QHX3DsDCdcNsb:IS5LPpV+0Ttr+heUrZ80gKmgYCU8RhHb
                                        MD5:9579E86B3DBAAFDB82E23ACDDECDCFEB
                                        SHA1:F0DC65BB4D4AACDEFF7287CE786213D3BAB612F6
                                        SHA-256:8076B6213C037DE30FD588095416310CB3FE996CB59D0EEBF4F32902E8C93ED4
                                        SHA-512:2C594258B345033710776F3CA00A621895E82A274E09A92A56D587D8458A89E84A68FFDD8BA8084429FFA95CF424E1BDFF892910716B0D9922899FBC50EB9CB8
                                        Malicious:false
                                        Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import "../../../gui/qml/components/wizard".import "../../../gui/qml/components/controls"..WizardComponent {. valid: otpVerified.. property QtObject plugin.. property bool otpVerified: false.. ColumnLayout {. width: parent.width.. Label {. text: qsTr('Authenticator secret'). }.. InfoTextArea {. id: errorBox. Layout.fillWidth: true. iconStyle: InfoTextArea.IconStyle.Error. visible: !otpVerified && plugin.remoteKeyState == 'error'. }.. InfoTextArea {. Layout.fillWidth: true. iconStyle: InfoTextArea.IconStyle.Warn. visible: plugin.remoteKeyState == 'wallet_known'. text: qsTr('This wallet is already registered with TrustedCoin. '). + qsTr('To finalize wallet creation, please enter your Google Authenticator Code. '). }.. QRImage {.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trustedcoin\qml\Terms.qml

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):1664
                                        Entropy (8bit):4.147635049972669
                                        Encrypted:false
                                        SSDEEP:24:I60KUOQdcWmcQ2HG5C+tEBAETFrXVAgXENHtP1eyUxGZSzAzCSAT8FCcCSiXL:I60KUOFWNpHBL3Ag0hBoyXyICjXL
                                        MD5:07F02079D50F78DA217FD0AE27EDE2C1
                                        SHA1:3007E9769D5C3F2CABAF9982A4702938B1EA7175
                                        SHA-256:4F7AD2042911BE29B1341B69BFCF9B96F3A07365ED411442343A8CC52E997FC3
                                        SHA-512:5BEDDBD8C6EBC17B12D6A57C9D9DB0FA5B873EFB51AFCBB7FCEB9CA02DDE0FBFC0840BEAADABC1C5B9DB61426F35A9EED73B5B1B79133E828055573D67E0EEB7
                                        Malicious:false
                                        Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import org.electrum 1.0..import "../../../gui/qml/components/wizard".import "../../../gui/qml/components/controls"..WizardComponent {. valid: !plugin ? false. : tosShown.. property QtObject plugin. property bool tosShown: false.. ColumnLayout {. anchors.fill: parent.. Label {. text: qsTr('Terms and conditions'). }.. TextHighlightPane {. Layout.fillWidth: true. Layout.fillHeight: true. rightPadding: 0.. Flickable {. anchors.fill: parent. contentHeight: termsText.height. clip: true. boundsBehavior: Flickable.StopAtBounds.. Label {. id: termsText. width: parent.width. rightPadding: constants.paddingSmall. wrapMode: Text.Wrap. }.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trustedcoin\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):24562
                                        Entropy (8bit):4.701707850115183
                                        Encrypted:false
                                        SSDEEP:384:Ro6St2QXexCeNDjm8A0pNtF/UqtaOugBbIXXFoqLLfvfsqNkjdNRHl:26StdteZjmv8NtF8qtaBJ7njNKp
                                        MD5:D189A164CF2BB14FC3699A43F7F67BD8
                                        SHA1:1D43F0A4033659E56B8757E95F6D95F0B59228DB
                                        SHA-256:0E0E5DD229A4B8FBE56B963DEBD0C4AEA09B7689E3BF64431D6302B7024711C5
                                        SHA-512:2682EA96CFE62DD511CE4667D0CEA5F25DA5BFC551D2CC645914ED86B42281010D768C1F92D152504B78123C1F8E9D1371859A814D008788FE82FE253335DAB8
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2015 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\trustedcoin\trustedcoin.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):27622
                                        Entropy (8bit):4.672349210966519
                                        Encrypted:false
                                        SSDEEP:192:cdwQHdx9KlVQIxD2B0wp+dIJ1ich38ppDdMhvlhpMWqhud+RTL58bX0HGTsK1A0L:RoixxSDofZTL5MhsFb355lfbOMcV
                                        MD5:C7012BDAF5468CAECF1D755E76591489
                                        SHA1:AF6124794CED1CE440519A6A3515853BBE1633A5
                                        SHA-256:F147B9073BFE678A99861B7624084423EE3A8426A84EAF951BAF83A4C9BCDCE4
                                        SHA-512:4154DFB6BE1B4DF712DA565ACE2455151C13C863B8D3921A05C406E594C5442E2E65F89C50F49285859D940FE59161D0FBA06CFA04F2423A40633E848BAB0AFB
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2015 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\virtualkeyboard\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):242
                                        Entropy (8bit):4.814099320310534
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhwQPVnda5u14Afv8gj5XtzTLZYvuTgXlWGVrIr:1YvQJlu5u2AfJtpLauucGV0r
                                        MD5:C2FC53DA569BBAEE6CBCB27F3746CE0B
                                        SHA1:0B7C01AFBC0EA31165FF39320E07000E573D1B93
                                        SHA-256:5EF1742F961BC7CBF3961A0E06CCFC58187D5D41F385309A73153C3524B7A273
                                        SHA-512:1C27B5476B1DF445609200B89711D5D0E3F524B11B1E146FB693B3B05B9446F019FA768C06348CFB11278DB18F80B791539AB9EFC1148361CD524BD9C545B3B1
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Virtual Keyboard'.description = '%s\n%s' % (_("Add an optional virtual keyboard to the password dialog."), _("Warning: do not use this if it makes you pick a weaker password.")).available_for = ['qt'].

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\plugins\virtualkeyboard\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1989
                                        Entropy (8bit):4.69457366463934
                                        Encrypted:false
                                        SSDEEP:48:Q6ReyWw9TzjWZEWKX1uT0/aHm96OHPSJds:b0yWUiq/2Ta6Pds
                                        MD5:48FBF4FD09D00CEBF3C2970F7F803476
                                        SHA1:5AD56DC851A74A39EF3082988060DDEBA7FCE10C
                                        SHA-256:0937910B1C26B9240D39C6FFB5A424AD7C9FE3C3B807147AD3F4B84ED62809D2
                                        SHA-512:A371C5ECA125DFC85BD367C0F7B89F7AC98E3ED6B8AAA2E4DBDAFACF92E47BF6311DD8FF5DA56D970AA58868D0386F87E10954238251ED6C5A3158AC6B605411
                                        Malicious:false
                                        Preview:import random..from PyQt5.QtWidgets import (QVBoxLayout, QGridLayout, QPushButton).from PyQt5.QtGui import QFontMetrics..from electrum.plugin import BasePlugin, hook.from electrum.i18n import _...class Plugin(BasePlugin):. vkb = None. vkb_index = 0.. @hook. def password_dialog(self, pw, grid, pos):. vkb_button = QPushButton("+"). font_height = QFontMetrics(vkb_button.font()).height(). vkb_button.setFixedWidth(round(1.7 * font_height)). vkb_button.clicked.connect(lambda: self.toggle_vkb(grid, pw)). grid.addWidget(vkb_button, pos, 2). self.kb_pos = 2. self.vkb = None.. def toggle_vkb(self, grid, pw):. if self.vkb:. grid.removeItem(self.vkb). self.vkb = self.virtual_keyboard(self.vkb_index, pw). grid.addLayout(self.vkb, self.kb_pos, 0, 1, 3). self.vkb_index += 1.. def virtual_keyboard(self, i, pw):. i = i % 3. if i == 0:. chars = 'abcdefghijklmnopqrstuvwxyz '.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\servers.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):10498
                                        Entropy (8bit):4.0827969081007405
                                        Encrypted:false
                                        SSDEEP:192:w/AJ9+NTen0vi0KIYxPkv5gAb1q4h6t/FA06FLWZoOW6BrxFie3UG0jpr6MdRgGd:cBCcP/V
                                        MD5:FCBF1CC8CF6A61B5729A1A78293C5D66
                                        SHA1:56F37B925043391EB8987FBFC3614FBD6C53C51F
                                        SHA-256:5B320E11B6AF674AB93C7FD2D89EA303A3A60634C4FBE3C8FB058DD4EF6BEAD3
                                        SHA-512:B7D5C1A1AA55B3BC537EDA3CF610F969D4EF3883127A911888E2A5BA201D51D53B0FB783B588A97A2EC3ED73F353C3AAFBF99478FCCFC3666DCDCA42FC0C35C5
                                        Malicious:false
                                        Preview:{. "104.248.139.211": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "128.0.190.26": {. "pruning": "-",. "s": "50002",. "version": "1.4.2". },. "142.93.6.38": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "157.245.172.236": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "159.65.53.177": {. "pruning": "-",. "t": "50001",. "version": "1.4.2". },. "167.172.42.31": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "188.230.155.0": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "22mgr2fndslabzvx4sj7ialugn2jv3cfqjb3dnj67a6vnrkp7g4l37ad.onion": {. "pruning": "-",. "t": "50001",. "version": "1.4.2". },. "2AZZARITA

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\servers_regtest.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):122
                                        Entropy (8bit):3.4854012322496546
                                        Encrypted:false
                                        SSDEEP:3:34QWFnXe5topFFF8HRF7HkBXF52S1kvNiAvn:3sA56+HIqS1kwAv
                                        MD5:FAE0E5714B66267E656500A0766784AC
                                        SHA1:B5078FE5B0F6B5E81C759A322684D74AF3B72F95
                                        SHA-256:5018BE2D11F596DF37E19F9AD0581D66C22C6D1F50B2BA1F4AFBFA32DED922A7
                                        SHA-512:9832E3C6EC7609481F36573EA987972B80B41F64CA650B14D5AB9BC1173708F354BEC8A5DAFD65CF8323BA0B79B37DBF4F1E952FA8B4D89369BE2D20E7966B2C
                                        Malicious:false
                                        Preview:{. "127.0.0.1": {. "pruning": "-",. "s": "51002",. "t": "51001",. "version": "1.4". }.}.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\servers_signet.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):366
                                        Entropy (8bit):3.8609658916403737
                                        Encrypted:false
                                        SSDEEP:6:3sA56+HIqS1kwL0OAGu8A56+uuUcS1kwLiOq0cfFwA56+V8S1kwAv:L6z1kwq16r/1kw2f0ctn6Qf1kwK
                                        MD5:27CC53FE12321059F03077930CD08D4B
                                        SHA1:56BBF7DA37D7EC3BFA30144746C47A5571790897
                                        SHA-256:0502A5A5C6ECC5BB89B6FD4987031BA72B94843E7149A226D3A7AD197117B230
                                        SHA-512:E92BCFCBC028F8960E5086042096DCD8B39B7E30412DF2016909C323199C292118A407ED84291C3DC6240938EAB861E1DEFEC84341ED932BE1E03F60718526E7
                                        Malicious:false
                                        Preview:{. "127.0.0.1": {. "pruning": "-",. "s": "51002",. "t": "51001",. "version": "1.4". },. "signet-electrumx.wakiyamap.dev": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4". },. "electrum.emzy.de": {. "pruning": "-",. "s": "53002",. "version": "1.4". }.}.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\servers_testnet.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1031
                                        Entropy (8bit):4.021117622225254
                                        Encrypted:false
                                        SSDEEP:24:4J40d1oQQf8I1P2v8A1P2I2YY1PrZQ1oA9xe1oAjQ18WP1K1PK:4J40nop8w+UI+CA1YoYCoyYnP1mS
                                        MD5:7EDE5F010661C804BC862C078E4514C0
                                        SHA1:48A7B56E2CAFF7C35C37541417E568E04C9130C6
                                        SHA-256:CD6BD116AF89B8DE77AD0A1A68A91672F0A219E39061A9CE324685D7652D4EA7
                                        SHA-512:0BF5283C0E713BCA7D58E5CDE4CC5B03F276F5C4D12862EB806EAB2B2E3C88FD8DD6CC6F64AEFAE06601927A24D5393EDF6A2AE237E6EC47FD5407EA8A9B62C4
                                        Malicious:false
                                        Preview:{. "blackie.c3-soft.com": {. "pruning": "-",. "s": "57006",. "t": "57005",. "version": "1.4.5". },. "blockstream.info": {. "pruning": "-",. "s": "993",. "t": "143",. "version": "1.4". },. "electrum.blockstream.info": {. "pruning": "-",. "s": "60002",. "t": "60001",. "version": "1.4". },. "explorerzydxu5ecjrkwceayqybizmpjjznk5izmitf2modhcusuqlid.onion": {. "pruning": "-",. "t": "143",. "version": "1.4". },. "testnet.aranguren.org": {. "pruning": "-",. "s": "51002",. "t": "51001",. "version": "1.4.2". },. "testnet.hsmiths.com": {. "pruning": "-",. "s": "53012",. "version": "1.4.2". },. "testnet.qtornado.com": {. "pruning": "-",. "s": "51002",. "t": "51001",. "version": "1.5". },. "tn.not.fyi": {. "pruning": "-",. "s": "55002",. "t": "55001",.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\wordlist\english.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):13116
                                        Entropy (8bit):4.2192956006819475
                                        Encrypted:false
                                        SSDEEP:192:DAvLtKog3W8jiD1/oLpsExUKqlyjn6SybkSoxIFg/7mSX30hB8OnqdE5HpF2gS2:MvLAog/I1wdsExXxigaSUvRj5r
                                        MD5:F23506956964FA69C98FA3FB5C8823B5
                                        SHA1:B2D5241AE027A0E40F06A33D909809A190F210FE
                                        SHA-256:2F5EED53A4727B4BF8880D8F3F199EFC90E58503646D9FF8EFF3A2ED3B24DBDA
                                        SHA-512:416C71BA30018EA292BB36CDC23C9329673485A8D8933266A9D9A7CC72153B8BAED3D430F52EAB4F5D3ADDF6583611B3777A50454599F1E42716F5F879621123
                                        Malicious:false
                                        Preview:abandon.ability.able.about.above.absent.absorb.abstract.absurd.abuse.access.accident.account.accuse.achieve.acid.acoustic.acquire.across.act.action.actor.actress.actual.adapt.add.addict.address.adjust.admit.adult.advance.advice.aerobic.affair.afford.afraid.again.age.agent.agree.ahead.aim.air.airport.aisle.alarm.album.alcohol.alert.alien.all.alley.allow.almost.alone.alpha.already.also.alter.always.amateur.amazing.among.amount.amused.analyst.anchor.ancient.anger.angle.angry.animal.ankle.announce.annual.another.answer.antenna.antique.anxiety.any.apart.apology.appear.apple.approve.april.arch.arctic.area.arena.argue.arm.armed.armor.army.around.arrange.arrest.arrive.arrow.art.artefact.artist.artwork.ask.aspect.assault.asset.assist.assume.asthma.athlete.atom.attack.attend.attitude.attract.auction.audit.august.aunt.author.auto.autumn.average.avocado.avoid.awake.aware.away.awesome.awful.awkward.axis.baby.bachelor.bacon.badge.bag.balance.balcony.ball.bamboo.banana.banner.bar.barely.bargain.barre

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\electrum\wordlist\slip39.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:C source, ASCII text
                                        Category:dropped
                                        Size (bytes):7231
                                        Entropy (8bit):4.235985120108038
                                        Encrypted:false
                                        SSDEEP:192:go28rtOqlnqd1su9Jgubann5D1fN2J4kmeY3:A8saqDbbIn5DNoJ4kO
                                        MD5:BF2027501393E153341E01B46BDF4A3B
                                        SHA1:650C1DF1DA9BD5499DD951837B45EBBB738AF82A
                                        SHA-256:BCC4555340332D169718AED8BF31DD9D5248CB7DA6E5D355140EF4F1E601EEC3
                                        SHA-512:57F1A57BE2EDA50E923D6C3766612745E2B22F14C16B683376F120E1FBB4F15D1C3E58CEEA9D4B3D3871A7FFAE94A1AB7AFD2E69CBFD53CC55A9A1C87CC586F6
                                        Malicious:false
                                        Preview:academic.acid.acne.acquire.acrobat.activity.actress.adapt.adequate.adjust.admit.adorn.adult.advance.advocate.afraid.again.agency.agree.aide.aircraft.airline.airport.ajar.alarm.album.alcohol.alien.alive.alpha.already.alto.aluminum.always.amazing.ambition.amount.amuse.analysis.anatomy.ancestor.ancient.angel.angry.animal.answer.antenna.anxiety.apart.aquatic.arcade.arena.argue.armed.artist.artwork.aspect.auction.august.aunt.average.aviation.avoid.award.away.axis.axle.beam.beard.beaver.become.bedroom.behavior.being.believe.belong.benefit.best.beyond.bike.biology.birthday.bishop.black.blanket.blessing.blimp.blind.blue.body.bolt.boring.born.both.boundary.bracelet.branch.brave.breathe.briefing.broken.brother.browser.bucket.budget.building.bulb.bulge.bumpy.bundle.burden.burning.busy.buyer.cage.calcium.camera.campus.canyon.capacity.capital.capture.carbon.cards.careful.cargo.carpet.carve.category.cause.ceiling.center.ceramic.champion.change.charity.check.chemical.chest.chew.chubby.cinema.civil.cl

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\hid.cp310-win32.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):78336
                                        Entropy (8bit):6.396606725288797
                                        Encrypted:false
                                        SSDEEP:1536:sRqRTyvCslycXWmiWEV7xZaGlgEyz0e3pCG:GmOvLMYWmUV3VgEyz0
                                        MD5:084F1A8DB3FDF6520F6B63D7489B1971
                                        SHA1:6A4855600B7EE4D387296D3952B005BCF4770DD2
                                        SHA-256:59E478CB62FFEAF7B3EACB59B3BB94C3225E3307B2CB2370FAAB55C3B99E93C7
                                        SHA-512:097A91821B52ACE69203DF03588E9D419979B308A592B1359386818C61FAC930743D4875E883377F4B21ABF3B8DC5CD51C444395AD61EF424201398F96C57C2E
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>a..P2..P2..P2...2..P2..Q3..P2..Q3..P2..U3..P2..T3..P2..S3..P26.Q3..P2..Q2K.P2C.X3..P2C.P3..P2C.2..P2C.R3..P2Rich..P2................PE..L...R7sd...........!...".....p............................................................@............................. ............P.......................`......X...................................@............................................text............................... ..`.rdata...9.......:..................@..@.data.... ... ......................@....rsrc........P......................@..@.reloc.......`....... ..............@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\libcrypto-1_1.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):2276120
                                        Entropy (8bit):6.111762453951637
                                        Encrypted:false
                                        SSDEEP:49152:3L7Iy5xntVyJSFtv3A8+QK1CPwDv3uFfJKShr:3L7Iy59nFdA8m1CPwDv3uFfJK+
                                        MD5:4633D62F19C0B25318B1C612995F5C21
                                        SHA1:50601F9E2B07D616FDE8EE387CE8CDCB0CA451DF
                                        SHA-256:47376D247AE6033BC30FEE4E52043D3762C1C0C177E3EC27CA46EFF4B95C69B0
                                        SHA-512:D6A18E43B1A20242F80265054ED8D33598439FFA5DF4920931FF43EC91F1AC2D8A3931913FD5569F48C9B1B9EA845D9E017EA23571A1AC1B352502A3E823ECA9
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..uk..uk..uk...k..uk..tj..uk..pj..uk..qj..uk..vj..uk..tko.uk..tj..uk2.qjs.uk2.uj..uk2..k..uk2.wj..ukRich..uk........PE..L......c...........!...".(...........g.......@................................#.....8."...@.........................`....h....!.T.....".|............."../....".4.......8...............................@.............!..............................text....&.......(.................. ..`.rdata..v*...@...,...,..............@..@.data...TY...p!......X!.............@....idata........!......n!.............@..@.00cfg........!.......!.............@..@.rsrc...|.....".......!.............@..@.reloc........".......!.............@..B................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\libffi-7.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):29208
                                        Entropy (8bit):6.643623418348
                                        Encrypted:false
                                        SSDEEP:384:l69PtXvz8cLBN3gHhY4AFlfIvDzqig2c2LuRRClfW23JLURlV5uH+6nYPLxDG4yG:l65tXvz2CTIvy2c26A35qYvWDG4yG
                                        MD5:BC20614744EBF4C2B8ACD28D1FE54174
                                        SHA1:665C0ACC404E13A69800FAE94EFD69A41BDDA901
                                        SHA-256:0C7EC6DE19C246A23756B8550E6178AC2394B1093E96D0F43789124149486F57
                                        SHA-512:0C473E7070C72D85AE098D208B8D128B50574ABEBBA874DDA2A7408AEA2AABC6C4B9018801416670AF91548C471B7DD5A709A7B17E3358B053C37433665D3F6B
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)..qm.."m.."m.."d.p"o.."?..#o.."...#n.."m.."I.."?..#f.."?..#g.."?..#n.."...#k.."...#l.."...#l.."...#l.."Richm.."................PE..L.....]...........!.....@...........E.......P......................................H.....@.........................pU.......X..P....................X.......p..<....R..............................0R..@............P...............................text...j>.......@.................. ..`.rdata..p....P.......D..............@..@.data........`.......R..............@....reloc..<....p.......T..............@..B................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\libsecp256k1-2.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                        Category:dropped
                                        Size (bytes):1191950
                                        Entropy (8bit):7.95358118007957
                                        Encrypted:false
                                        SSDEEP:24576:FLc/LDeIWs9GsChyXuRtANMoQRELx/pYuhIe57Low7X4k:FGnWs0YGANMoywHhSC7LPB
                                        MD5:EA146BC906C10F8F8A6BD96E54174966
                                        SHA1:6962DF1C2AFF684F6BA568FDA055CE7905122421
                                        SHA-256:6C6326835F4794B368505EB553384F043CA1E21488EEA06147435B6F2A2CF737
                                        SHA-512:A9C5E5B5B371CD068126AF0E5CC59581244E81F26444CE5431CDD2B2E1347EA3864367B5F36329DA0E30FFA4482163170790B4F2D5629949030D8D8B8429E709
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........0.........#...#.....,.....................k.................................|........ ......................`.......p..l...............................P....................................................p...............................text...$...........................`.P`.data...0...........................@.0..rdata...g.......h..................@.`@/4......T$... ...&..................@.0@.bss.........P........................0..edata.......`......................@.0@.idata..l....p......."..............@.0..CRT....,............&..............@.0..tls.................(..............@.0..reloc..P............*..............@.0B................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\libssl-1_1.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):552216
                                        Entropy (8bit):5.779566253639773
                                        Encrypted:false
                                        SSDEEP:12288:MaYPTKwDsuz9V/9SYeujF59CF5e3SnEEATLU2lvzS7u:nYPTRDD9ND58GqbATLU2lvzS7u
                                        MD5:8845FCF1AE2DE1018DAAAEA01D9BA2D5
                                        SHA1:DB67697EE052738E6F23CC1D29B261BEF1D423E5
                                        SHA-256:B7E16AF3EFF9AB0869CFE60C256394A70A867879B7F56544A724D6AC1CCFAB88
                                        SHA-512:2792FE94DD35B594514C4FAD091C9683EC47814335D046F776CD1F043C576533E99088949F1F1AE6814C16DBDDA430EC53B2D64621EA0C818CADB91EC5E3A788
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x.._x.._x.._qf._t.._7b.^z.._3f.^z.._7b.^s.._7b.^r.._7b.^z.._.b.^{.._x.._..._.b.^T.._.b.^y.._.ba_y.._.b.^y.._Richx.._........................PE..L......c...........!...".....4......."....... ......................................P.....@......................... =...N...........0..s............>.../...@...6...,..8............................+..@............................................text...-........................... ..`.rdata..*k... ...l..................@..@.data....;.......6...|..............@....idata..dA.......B..................@..@.00cfg....... ......................@..@.rsrc...s....0......................@..@.reloc..)>...@...@..................@..B........................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\libusb-1.0.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                        Category:dropped
                                        Size (bytes):219662
                                        Entropy (8bit):6.498800717506742
                                        Encrypted:false
                                        SSDEEP:3072:yL40BTtebjPofSJqYtdKZMy4ZKmJo5RFjXPicaW/jmkfEc7fNQ8juEnLQLyE:yXujMSgYtUZMy4ZKmJ2RFjXT/jmglB2
                                        MD5:F4A98FEA2565D76FC7AEE8195F955CD0
                                        SHA1:6FBBF899BA474419E21042CF81D7D9D4F12F1040
                                        SHA-256:E70158FEF09E1B5EE8BB416EC4F3ADA620C06E0ED54C44E850572E99863F43C3
                                        SHA-512:3A4987994A93F487782C89D8645CEF399D4AE21CEA75D36B9FD5E2ADC0253B3E975D947E73C046DE44BED99D0670E6E14BCB1F1EFD751FC9CCB0888B8A3A929B
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........Z.........#...#.@...V...............P.....k................................=:........ ......................@.......`..$....................................................................................a...............................text....>.......@..................`.P`.data........P.......D..............@.`..rdata.......`.......H..............@.`@/4.......6.......8..................@.0@.bss.........0........................`..edata.......@... ..................@.0@.idata..$....`.......(..............@.0..CRT....,....p.......4..............@.0..tls.................6..............@.0..rsrc................8..............@.0..reloc...............>..............@.0B........................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\libzbar-0.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                        Category:dropped
                                        Size (bytes):281102
                                        Entropy (8bit):6.455757924389761
                                        Encrypted:false
                                        SSDEEP:6144:0nbKPzmx2iUlsLt1LaOdfPyb5Zrziwis7q63lI:0nbKPzmx2iUlsLHiH571lI
                                        MD5:042DA22F1B7CF72B878A62A0DB6C6080
                                        SHA1:6EEB12444A784E3469820AE7D4326382DBCC1DEE
                                        SHA-256:FBDC809E73A718ACDF291393223F1516F517CC3C2A5C2F0F4FFC26E0C8D9CCBA
                                        SHA-512:34CF16461FCD9C0AC996C5CA4BE1D7277F770364928195A261AC516B4669376E87F0F891D2C198ECE5FF03B41193EF1B544FA0902A6528E361FADF9557E95801
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........J.........#...#.8...F...............P.....j......................................... ......................0.......P................................... ..................................................TS...............................text...$6.......8..................`.P`.data........P.......<..............@.`..rdata...Z...`...\...J..............@.`@/4.......P.......R..................@.0@.bss......... ........................`..edata.......0......................@.0@.idata.......P......................@.0..CRT....0....p....... ..............@.0..tls................."..............@.0..rsrc................$..............@.0..reloc... ......."...(..............@.0B........................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\mnemonic\py.typed

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):27
                                        Entropy (8bit):3.9265716511782736
                                        Encrypted:false
                                        SSDEEP:3:SZeW0FOoc:SZeRFHc
                                        MD5:48734178084EF7F5C250997C28F8BDEE
                                        SHA1:4D7BB7A1D9B08B32C6FFBAFCE440959D0BC19788
                                        SHA-256:6D67B0F661E0332F0BA8CBBB46EA905C55CB071876091C747546D2C7EDF0138F
                                        SHA-512:A227E9E2B7FC025767B4363544B4C4A675A123A853E68C740E659E662C354030F655B8FDA1D6CDF57B58CCA32A4757195F76D7A4A93048D334F047E7693F3335
                                        Malicious:false
                                        Preview:# Marker file for PEP 561..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\mnemonic\wordlist\chinese_simplified.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):5.097279386012455
                                        Encrypted:false
                                        SSDEEP:192:RC/PE+flkDFk4kVOAUAIXYP9laqCFd5zJ007:R4E65uYPVCFLzJ
                                        MD5:0C5517AB8EDB22EA7A61E44B28E96DA7
                                        SHA1:F902EE7E96CE48DE6404ADF644FA40E260D949FF
                                        SHA-256:5C5942792BD8340CB8B27CD592F1015EDF56A8C5B26276EE18A482428E7C5726
                                        SHA-512:F5B6D696A6B75BDEEACD0E0742D31EAA06CD683BB3C149052D82E0D47039534B23C82FC47FB193C86FF2B7C2B22F73CCC48CC500F09ABC5E228998D9BC413EF7
                                        Malicious:false
                                        Preview:....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\mnemonic\wordlist\chinese_traditional.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):5.099678321615091
                                        Encrypted:false
                                        SSDEEP:192:UPmINi9ODjMzdZmIBI3C8+o95uECRdDGrRPY2+PDv:Ucfz7lqyHo9RCz2wLPDv
                                        MD5:00D0909E346B52006D1E9EF680B5A5FC
                                        SHA1:33E401BEA63F83A5EA84D78DDC7161809EF77F0B
                                        SHA-256:417B26B3D8500A4AE3D59717D7011952DB6FC2FB84B807F3F94AC734E89C1B5F
                                        SHA-512:1E2689A48317A12A6B4A6A74DE2241380FEF57B250FAFE6AB00A479DB85D12661F8C33749240C9CEC6535ACD7F91E71DCBA0BB8A27D1D32A3B76FE34797CAD5B
                                        Malicious:false
                                        Preview:....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\mnemonic\wordlist\czech.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):14945
                                        Entropy (8bit):4.229683397391918
                                        Encrypted:false
                                        SSDEEP:384:6kfPbFvdXqyyLlY3fIVKj7KyvKxv/FjZ305yyRvQcR5bJw:lbrXqyyLS31/Kyviv/FaAyttR59w
                                        MD5:38FD5E100D4604C2A844BB9BB9305975
                                        SHA1:33A09B9BC987AAA8560FFEF8A17459C99C63ED4A
                                        SHA-256:7E80E161C3E93D9554C2EFB78D4E3CEBF8FC727E9C52E03B83B94406BDCC95FC
                                        SHA-512:3D56A9D507B5B07A99B9D9924D8540944DD226D4B5050852027F09309A85513DB2E57C9186F70B8F8226C342C28EFCEDD1E8EDD507E1D39F8DA693CFAC0C39CA
                                        Malicious:false
                                        Preview:abdikace.abeceda.adresa.agrese.akce.aktovka.alej.alkohol.amputace.ananas.andulka.anekdota.anketa.antika.anulovat.archa.arogance.asfalt.asistent.aspirace.astma.astronom.atlas.atletika.atol.autobus.azyl.babka.bachor.bacil.baculka.badatel.bageta.bagr.bahno.bakterie.balada.baletka.balkon.balonek.balvan.balza.bambus.bankomat.barbar.baret.barman.baroko.barva.baterka.batoh.bavlna.bazalka.bazilika.bazuka.bedna.beran.beseda.bestie.beton.bezinka.bezmoc.beztak.bicykl.bidlo.biftek.bikiny.bilance.biograf.biolog.bitva.bizon.blahobyt.blatouch.blecha.bledule.blesk.blikat.blizna.blokovat.bloudit.blud.bobek.bobr.bodlina.bodnout.bohatost.bojkot.bojovat.bokorys.bolest.borec.borovice.bota.boubel.bouchat.bouda.boule.bourat.boxer.bradavka.brambora.branka.bratr.brepta.briketa.brko.brloh.bronz.broskev.brunetka.brusinka.brzda.brzy.bublina.bubnovat.buchta.buditel.budka.budova.bufet.bujarost.bukvice.buldok.bulva.bunda.bunkr.burza.butik.buvol.buzola.bydlet.bylina.bytovka.bzukot.capart.carevna.cedr.cedule.cejch.cej

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\mnemonic\wordlist\english.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):13116
                                        Entropy (8bit):4.2192956006819475
                                        Encrypted:false
                                        SSDEEP:192:DAvLtKog3W8jiD1/oLpsExUKqlyjn6SybkSoxIFg/7mSX30hB8OnqdE5HpF2gS2:MvLAog/I1wdsExXxigaSUvRj5r
                                        MD5:F23506956964FA69C98FA3FB5C8823B5
                                        SHA1:B2D5241AE027A0E40F06A33D909809A190F210FE
                                        SHA-256:2F5EED53A4727B4BF8880D8F3F199EFC90E58503646D9FF8EFF3A2ED3B24DBDA
                                        SHA-512:416C71BA30018EA292BB36CDC23C9329673485A8D8933266A9D9A7CC72153B8BAED3D430F52EAB4F5D3ADDF6583611B3777A50454599F1E42716F5F879621123
                                        Malicious:false
                                        Preview:abandon.ability.able.about.above.absent.absorb.abstract.absurd.abuse.access.accident.account.accuse.achieve.acid.acoustic.acquire.across.act.action.actor.actress.actual.adapt.add.addict.address.adjust.admit.adult.advance.advice.aerobic.affair.afford.afraid.again.age.agent.agree.ahead.aim.air.airport.aisle.alarm.album.alcohol.alert.alien.all.alley.allow.almost.alone.alpha.already.also.alter.always.amateur.amazing.among.amount.amused.analyst.anchor.ancient.anger.angle.angry.animal.ankle.announce.annual.another.answer.antenna.antique.anxiety.any.apart.apology.appear.apple.approve.april.arch.arctic.area.arena.argue.arm.armed.armor.army.around.arrange.arrest.arrive.arrow.art.artefact.artist.artwork.ask.aspect.assault.asset.assist.assume.asthma.athlete.atom.attack.attend.attitude.attract.auction.audit.august.aunt.author.auto.autumn.average.avocado.avoid.awake.aware.away.awesome.awful.awkward.axis.baby.bachelor.bacon.badge.bag.balance.balcony.ball.bamboo.banana.banner.bar.barely.bargain.barre

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\mnemonic\wordlist\french.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):16777
                                        Entropy (8bit):4.213242727095934
                                        Encrypted:false
                                        SSDEEP:384:6J+AAri16KDuR4ckw3ezywsNB7CJEu4XjooTiOPMk8YTCm:6IAYi16muR4GezyhNB7r0HG8EP
                                        MD5:F5905FD22FD0DEB0BE40F356204BA3FB
                                        SHA1:BCD81ED81906BDAB57D9700A23413A7E22487D0E
                                        SHA-256:EBC3959AB7801A1DF6BAC4FA7D970652F1DF76B683CD2F4003C941C63D517E59
                                        SHA-512:001B2E7D1D17416776FA5306E4F7EC5812F3F35CC26FDE46800A7DAB1412870AC8B779B0C2FEC1D75C24B80868E55BC5BFB88C8DED50C84040248B76A2C5332D
                                        Malicious:false
                                        Preview:abaisser.abandon.abdiquer.abeille.abolir.aborder.aboutir.aboyer.abrasif.abreuver.abriter.abroger.abrupt.absence.absolu.absurde.abusif.abyssal.acade.mie.acajou.acarien.accabler.accepter.acclamer.accolade.accroche.accuser.acerbe.achat.acheter.aciduler.acier.acompte.acque.rir.acronyme.acteur.actif.actuel.adepte.ade.quat.adhe.sif.adjectif.adjuger.admettre.admirer.adopter.adorer.adoucir.adresse.adroit.adulte.adverbe.ae.rer.ae.ronef.affaire.affecter.affiche.affreux.affubler.agacer.agencer.agile.agiter.agrafer.agre.able.agrume.aider.aiguille.ailier.aimable.aisance.ajouter.ajuster.alarmer.alchimie.alerte.alge.bre.algue.alie.ner.aliment.alle.ger.alliage.allouer.allumer.alourdir.alpaga.altesse.alve.ole.amateur.ambigu.ambre.ame.nager.amertume.amidon.amiral.amorcer.amour.amovible.amphibie.ampleur.amusant.analyse.anaphore.anarchie.anatomie.ancien.ane.antir.angle.angoisse.anguleux.animal.annexer.annonce.annuel.anodin.anomalie.anonyme.anormal.antenne.antidote.anxieux.apaiser.ape.ritif.a

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\mnemonic\wordlist\italian.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):16033
                                        Entropy (8bit):4.007887655086134
                                        Encrypted:false
                                        SSDEEP:384:7TRlelKQfV+XsNs6d6NN5Qd3kR72+ImtKlhT3sdHy1WVO0iiG:7TmBtP7dwN5Qpi4lG1VO0a
                                        MD5:FBE635509A2859B7B6DE2C0F16F15ED8
                                        SHA1:C6214EB1CEC7B1EE8CBA1F317AC612C51881448A
                                        SHA-256:D392C49FDB700A24CD1FCEB237C1F65DCC128F6B34A8AACB58B59384B5C648C2
                                        SHA-512:D3DCA24CF03F04EEA1872D98C91748A8AA7AEAC6E2C885A99F2D452904A75FFCF271506DB369335726C0E3F7C8A6454935782586414B9AFFD2FE0EB004223DA1
                                        Malicious:false
                                        Preview:abaco.abbaglio.abbinato.abete.abisso.abolire.abrasivo.abrogato.accadere.accenno.accusato.acetone.achille.acido.acqua.acre.acrilico.acrobata.acuto.adagio.addebito.addome.adeguato.aderire.adipe.adottare.adulare.affabile.affetto.affisso.affranto.aforisma.afoso.africano.agave.agente.agevole.aggancio.agire.agitare.agonismo.agricolo.agrumeto.aguzzo.alabarda.alato.albatro.alberato.albo.albume.alce.alcolico.alettone.alfa.algebra.aliante.alibi.alimento.allagato.allegro.allievo.allodola.allusivo.almeno.alogeno.alpaca.alpestre.altalena.alterno.alticcio.altrove.alunno.alveolo.alzare.amalgama.amanita.amarena.ambito.ambrato.ameba.america.ametista.amico.ammasso.ammenda.ammirare.ammonito.amore.ampio.ampliare.amuleto.anacardo.anagrafe.analista.anarchia.anatra.anca.ancella.ancora.andare.andrea.anello.angelo.angolare.angusto.anima.annegare.annidato.anno.annuncio.anonimo.anticipo.anzi.apatico.apertura.apode.apparire.appetito.appoggio.approdo.appunto.aprile.arabica.arachide.aragosta.araldica.arancio.aratur

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\mnemonic\wordlist\japanese.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):26423
                                        Entropy (8bit):3.554983747162495
                                        Encrypted:false
                                        SSDEEP:768:OwUkxkf27FkrH9tW/JgODfFFuHgFFqfw8QCBdqLMCl:Ogxkf27FkrdtW/JgOD9FuHgFFqfwLidW
                                        MD5:C71FCA9FD3FE9F85514CB38A58859DE2
                                        SHA1:A4EC1DA6C11A8C251195C7AD90817DDA6FE64488
                                        SHA-256:2EED0AEF492291E061633D7AD8117F1A2B03EB80A29D0E4E3117AC2528D05FFD
                                        SHA-512:3FAF87F7E48EB6635F7D7B18A34E7DACBC2C43A1CF6AA9C96015B2A3549710B8B7A0961E5D2E32D7E369099DB89A874C4D761A8384FB558744C7F47CA8CB0772
                                        Malicious:false
                                        Preview:................................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\mnemonic\wordlist\korean.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):37832
                                        Entropy (8bit):3.7380887691649907
                                        Encrypted:false
                                        SSDEEP:384:m57ktAhYlpH/gN8G3Ufyy7+Lp5vx5fBECMLJbnSTyKeeHjbnHeRigUuVyS+sOpVl:MSWhGES2O/r6
                                        MD5:EC271D4926B82EF5C02AEFA7DD2DAAF4
                                        SHA1:6C5C5F38E75673D1CEA20F2700468ADC163D869B
                                        SHA-256:9E95F86C167DE88F450F0AAF89E87F6624A57F973C67B516E338E8E8B8897F60
                                        SHA-512:E645A1E0F26F2727A8FB7605D3B59668A670C9DF04D07576FE473D844A23D0192020AEDC286FBB9B1F64709AD30E6ACB825803CF9F872954C1324AEFD4977710
                                        Malicious:false
                                        Preview:..................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\mnemonic\wordlist\portuguese.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):15671
                                        Entropy (8bit):4.053540036444415
                                        Encrypted:false
                                        SSDEEP:384:XM3AG0Qk5DN0Wf3MmmzpjbdU5nTEHkYk0h3Vcf+VDG:c3AQMJ0Wf3HWby5QHkY9Vcf+tG
                                        MD5:05EE6FDE129776830351BBACD5B0DCFB
                                        SHA1:472727867B394A1C9168690C415B0094DC3A3383
                                        SHA-256:2685E9C194C82AE67E10BA59D9EA5345A23DC093E92276FC5361F6667D79CD3F
                                        SHA-512:0E6AA42870C6F9A77BDA0931EA9423FEBFFEFBEB49E9DBDA5FA732FC3479942629050517FEF57BB1A76026195E16785186C0CFE26261C8FCC31F52FE69BEDA0F
                                        Malicious:false
                                        Preview:abacate.abaixo.abalar.abater.abduzir.abelha.aberto.abismo.abotoar.abranger.abreviar.abrigar.abrupto.absinto.absoluto.absurdo.abutre.acabado.acalmar.acampar.acanhar.acaso.aceitar.acelerar.acenar.acervo.acessar.acetona.achatar.acidez.acima.acionado.acirrar.aclamar.aclive.acolhida.acomodar.acoplar.acordar.acumular.acusador.adaptar.adega.adentro.adepto.adequar.aderente.adesivo.adeus.adiante.aditivo.adjetivo.adjunto.admirar.adorar.adquirir.adubo.adverso.advogado.aeronave.afastar.aferir.afetivo.afinador.afivelar.aflito.afluente.afrontar.agachar.agarrar.agasalho.agenciar.agilizar.agiota.agitado.agora.agradar.agreste.agrupar.aguardar.agulha.ajoelhar.ajudar.ajustar.alameda.alarme.alastrar.alavanca.albergue.albino.alcatra.aldeia.alecrim.alegria.alertar.alface.alfinete.algum.alheio.aliar.alicate.alienar.alinhar.aliviar.almofada.alocar.alpiste.alterar.altitude.alucinar.alugar.aluno.alusivo.alvo.amaciar.amador.amarelo.amassar.ambas.ambiente.ameixa.amenizar.amido.amistoso.amizade.amolador.amontoar.a

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\mnemonic\wordlist\russian.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):26538
                                        Entropy (8bit):3.827508989563015
                                        Encrypted:false
                                        SSDEEP:384:ou+5yukI02DpvaXhg8CnLOTsPsyOB7lanqA1p6tut/Mf2:H+5SIjDpvaXhrUSTsPsBBpand7xxMf2
                                        MD5:8950901A308B43D263E31A377306D987
                                        SHA1:7792B55B1838FAA8928C2528D304C2044ECD87BF
                                        SHA-256:07F11AF3F07FD13D8D74859F4448D8BCA8F1D9D336DC4842531ECEA083103A26
                                        SHA-512:5B747B7345E23F34DAFB35AFD9C2CB66AAD51456A7ACCBD9BF9CA7C285498A74C50647DA4D553AF763505935E1519F61204DB87D998B09583CC2585C91833B6B
                                        Malicious:false
                                        Preview:.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\mnemonic\wordlist\spanish.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):13996
                                        Entropy (8bit):4.187487403267613
                                        Encrypted:false
                                        SSDEEP:384:7SvbJ9E182qrUD0py4gnW6ji3Jl3ggHQqy8:s9ET1DsyXnne3xX
                                        MD5:5171EE312F7709BEC7660BC9AC07351A
                                        SHA1:B99205D24970E0ADA8E2182A1A68F1EB439C95A1
                                        SHA-256:46846A5A0139D1E3CB77293E521C2865F7BCDB82C44E8D0A06A2CD0ECBA48C0B
                                        SHA-512:0E838229265DE6C80505088682D2DC9510147C3AB1713B556B594D09529B493CC3A7E391AD690DDA2052D4E11C56572F8A215A7FFFDB2630B13B4637329F3C31
                                        Malicious:false
                                        Preview:a.baco.abdomen.abeja.abierto.abogado.abono.aborto.abrazo.abrir.abuelo.abuso.acabar.academia.acceso.accio.n.aceite.acelga.acento.aceptar.a.cido.aclarar.acne..acoger.acoso.activo.acto.actriz.actuar.acudir.acuerdo.acusar.adicto.admitir.adoptar.adorno.aduana.adulto.ae.reo.afectar.aficio.n.afinar.afirmar.a.gil.agitar.agoni.a.agosto.agotar.agregar.agrio.agua.agudo.a.guila.aguja.ahogo.ahorro.aire.aislar.ajedrez.ajeno.ajuste.alacra.n.alambre.alarma.alba.a.lbum.alcalde.aldea.alegre.alejar.alerta.aleta.alfiler.alga.algodo.n.aliado.aliento.alivio.alma.almeja.almi.bar.altar.alteza.altivo.alto.altura.alumno.alzar.amable.amante.amapola.amargo.amasar.a.mbar.a.mbito.ameno.amigo.amistad.amor.amparo.amplio.ancho.anciano.ancla.andar.ande.n.anemia.a.ngulo.anillo.a.nimo.ani.s.anotar.antena.antiguo.antojo.anual.anular.anuncio.an.adir.an.ejo.an.o.apagar.aparato.apetito.apio.aplicar.apodo.aporte.apoyo.aprender.aprobar.apuesta.apuro.arado.aran.a.arar.a.rbitro.a.rbol.arbusto.archivo.arc

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\mnemonic\wordlist\turkish.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):15324
                                        Entropy (8bit):4.562888468144625
                                        Encrypted:false
                                        SSDEEP:384:RyHE73AnXs3FzmzZIPXJBmqM0yHvnWMGRUIHF3N09GU:RWE7QnX6PPX7M0yPnvGHl3N0GU
                                        MD5:BA9ADCC5210C101DF4B26871504F253D
                                        SHA1:C0AEDCD8297FB58456C0A60854E04B547DFC9576
                                        SHA-256:A7DC9C77913726106C7B8BAA022B7E17601D118ACF40AA60AB1FBC9C91B383AC
                                        SHA-512:D16BADD39006E06FC5AD03AA7AA622ED19A19271E300061183BFA7A2F913919E8A0C831BC74FA3E6DEE1EC35AF01AC904D2617EC3EF7DFA3FADE6EBEF788E218
                                        Malicious:false
                                        Preview:abajur.abak.s.abart..abdal.abdest.abiye.abluka.abone.absorbe.abs.rt.acayip.acele.acemi.a..kg.z.adalet.adam.adezyon.adisyon.adliye.adres.afacan.afili.afi..afiyet.aforizm.afra.a.a..a..r.ahbap.ahkam.ahlak.ahtapot.aidat.aile.ajan.akademi.akarsu.akba..akci.er.akdeniz.ak.bet.ak.l.ak.nt..akide.akrep.akrobasi.aksiyon.ak.am.aktif.akt.r.aktris.akustik.alaca.alb.m.al.ak.aldanma.aleni.alet.alfabe.alg.lama.al.ngan.alk...alkol.alpay.alperen.alt.n.alt.st.altyap..alyuvar.amade.amat.r.amazon.ambalaj.amblem.ambulans.amca.amel.amigo.amir.amiyane.amorti.ampul.anadolu.anahtar.anakonda.anaokul.anapara.anar.i.anatomi.anayasa.anekdot.anestezi.angaje.anka.anket.anlaml..anne.anomali.anonim.anten.antla.ma.apse.araba.arac..araf.arbede.arda.arefe.arena.argo.arg.man.arkada..armoni.aroma.arsa.ars.z.art..artist.aruz.asans.r.asayi..asfalt.asgari.asil.asker.ask..aslan.asosyal.astsubay.asya.a....a..r..a.ure.atabey.ataman.ate..atmaca.atmosfer.atom.at.lye.avc..avdet.avize.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\pyexpat.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):170264
                                        Entropy (8bit):6.693484567356425
                                        Encrypted:false
                                        SSDEEP:3072:M5QtHVOqzYcylPwZzS8JqTuo0BmSWjIuVBY/xux08YvVILLh8ptCuX5x+:M2tHjzYcyu+unESWXA/xaYvD0
                                        MD5:92C72753FA5C8EAA615B007F89CDB482
                                        SHA1:34238E31E0D963838FF551B184EAB3267767AD12
                                        SHA-256:EBBDE07AFB2BB356CD400E97D8AFB5ABBC121CC0CC90F99BEC9C3FA5CA60DE14
                                        SHA-512:A80BBA7095E7178591266E411414B3A6A2CBA09B79F330631AC07A72C6EB2AFD1C50D7346938ED337A911307B15660C17D14FACC7AFC6EFD9759BFBEC2121BD6
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i^C.-?-.-?-.-?-.$G..#?-..J,./?-..J(.!?-..J).'?-..J../?-..J,./?-.fG,..?-.-?,._?-..J%.)?-..J-.,?-..J..,?-..J/.,?-.Rich-?-.........PE..L...M.,d...........!......................................................................@..........................:..P...`:.......p...............j.../......( ...5..T............................5..@............................................text............................... ..`.rdata...U.......V..................@..@.data........P.......2..............@....rsrc........p.......>..............@..@.reloc..( ......."...H..............@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\python3.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):65816
                                        Entropy (8bit):6.185813124894273
                                        Encrypted:false
                                        SSDEEP:768:rU8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqv:rUwewnvtjnsfwIVILL0s7SytPxS
                                        MD5:CD87B0D055B7ECE0C469A2562EDE9DD3
                                        SHA1:0EC9300BC910D5CECE38869AAD4FF8A28F10A09B
                                        SHA-256:260B946068120C33460F0992C01AD413B6D464A056CB0D1F83C39FCBCC2FCBAB
                                        SHA-512:290D4DFFA1E4A897BF12A971CEF59149749BB980F2DB3DBD0C907FC6C6544456A9C58D89A5BCDDB8151BC5260A268646A95FBCFE5A5C3AD69F94B271A3B622E4
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........A.d.A.d.A.d...l.@.d...d.@.d.....@.d...f.@.d.RichA.d.PE..L...!.,d...........!......................................................................@.........................`...`................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@....!.,d........7...............!.,d........................!.,d........|...$...$...........................D1......F...F............*..^1...1...1...1...2..B2..x2...2...2..&3..L3..w3...3...3...4..P4...4...4...4...5..=5..p5...5...5...6..56..f6...6...6...6../7..S7..w7...7...7...8..<8..j8...8...8...8...9..<9..g9...9...9...:..3:..c:...:...:...:...;..R;...;...;...;..#<..[<...<...<...<...=..?=...=...=...=..&>..[>...>...>...>..+?.._?...?...?...@..E@..}@...@...@...A..>A..lA...A...A...A..+B..

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\python310.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):4143384
                                        Entropy (8bit):6.719606889163802
                                        Encrypted:false
                                        SSDEEP:49152:0izdDWQcAdLh1ckY/wqIEh8rvZGsIBGfHP2MZnaPxQ1w7OEnGI8wgJyf:0uAk3rWBcH+MZ0Q1wlnYZJY
                                        MD5:73CADAB187AD5E06BEF954190478E3AA
                                        SHA1:18AB7B6FE86193DF108A5A09E504230892DE453E
                                        SHA-256:B4893ED4890874D0466FCA49960D765DD4C2D3948A47D69584F5CC51BBBFA4C9
                                        SHA-512:B2EBE575F3252FF7ABEBAB23FC0572FC8586E80D902D5A731FB7BD030FAA47D124240012E92FFE41A841FA2A65C7FB110AF7FB9AB6E430395A80E925283E2D4D
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d...............p.......jf......p.......p.......p.......}.......}...............p.......p.......pd......p......Rich............PE..L.....,d...........!......$...........$.......$...............................B......3@...@..........................%:.......:.|.....?...............?../....?.l1..(.9.T.............................9.@.............$..............................text.....$.......$................. ..`.rdata...F....$..H....$.............@..@.data.........;.......:.............@...PyRuntimh.....?.......<.............@....rsrc.........?.......<.............@..@.reloc..l1....?..2....<.............@..B................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bcash_tx_502e8577b237b0152843a416f8f1ab0c63321b1be7a8cad7bf5c5c216fcf062c.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1885
                                        Entropy (8bit):5.255142499174794
                                        Encrypted:false
                                        SSDEEP:24:YVNA5wP62ZawdeqFWNA5K2ZWEEnSFjrDEfewL1ln5bqAvpHBdgSGCWYEH8XSk5Ea:Yni2Iwdo2o2rrA/qABHBdg81SyxHSJo
                                        MD5:D11BCE86BBB84EEDB70042A410931BB3
                                        SHA1:C5B0F891BD08421920B17B89F1777FAEB629D28B
                                        SHA-256:8CFB4D1D0C5C4CF36E231D9955DD38F460E33D5CC219AFFF48B422D980504BC2
                                        SHA-512:072ADA09F6DC9ED39E9849B7059BACD54A8993C2295A3AA3E570E72D3502082A773A32D49FBC52AC81DD1D2483D30D0D58CF38998AC45129BECE3D11D7D4188F
                                        Malicious:false
                                        Preview:{"vout": [{"scriptPubKey": {"type": "pubkeyhash", "asm": "OP_DUP OP_HASH160 b1401fce7e8bf123c88a0467e0ed11e3b9fbef54 OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["1HADRPJpgqBzThepERpVXNi6qRgiLQRNoE"], "hex": "76a914b1401fce7e8bf123c88a0467e0ed11e3b9fbef5488ac"}, "n": 0, "spentHeight": 478743, "value": "0.01896050", "spentTxId": "5594fd9e5e26dcb4437cbbbba517401720849159bac4e2158e1e6401ffd5fdb7", "spentIndex": 0}, {"scriptPubKey": {"type": "pubkeyhash", "asm": "OP_DUP OP_HASH160 d51eca49695cdf47e7f4b55507893e3ad53fe9d8 OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["1LRspCZNFJcbuNKQkXgHMDucctFRQya5a3"], "hex": "76a914d51eca49695cdf47e7f4b55507893e3ad53fe9d888ac"}, "n": 1, "spentHeight": 478743, "value": "0.00073452", "spentTxId": "5594fd9e5e26dcb4437cbbbba517401720849159bac4e2158e1e6401ffd5fdb7", "spentIndex": 1}], "fees": 0.00025842, "size": 225, "confirmations": 383, "blockheight": 478743, "txid": "502e8577b237b0152843a416f8f1ab0c63321b1be7a8cad7bf5c5c216fcf062c", "blockhash": "0000000000000

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bcash_tx_8b6db9b8ba24235d86b053ea2ccb484fc32b96f89c3c39f98d86f90db16076a0.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2028
                                        Entropy (8bit):4.96188924342764
                                        Encrypted:false
                                        SSDEEP:24:YV7UzUiK2FocJxxw8O3VcRfnXqqhxZkCWOMS2Q0NCIZm0xttyR2QrIZmRttyG1nn:Y9UpKgxgMvq4sRttyL0qttyu
                                        MD5:E17D0CCA6B9442822B1DB16937DB0DE7
                                        SHA1:BC4DDD686E0270894F882DCCE0064F7684B2F373
                                        SHA-256:CFC6E06077329625E665010F1DEFBFFAEC067C530590F5643C8D82AD385E4EF9
                                        SHA-512:F6C9FAE92AF950E459E519A7D9AEDD17168914FE4AD178872D7645DF286710967E14B3B660A8C8DB45F8C91706C6074C4586D9229A8AA833185E397ABD442DF4
                                        Malicious:false
                                        Preview:{"vout": [{"scriptPubKey": {"type": "scripthash", "asm": "OP_HASH160 11c1566006ab2b8e8c8d981055b090ecdefa9771 OP_EQUAL", "addresses": ["33Ju286QvonBz5N1V754ZekQv4GLJqcc5R"], "hex": "a91411c1566006ab2b8e8c8d981055b090ecdefa977187"}, "n": 0, "spentHeight": -1, "value": "0.00048490", "spentTxId": "f68caf10df12d5b07a34601d88fa6856c6edcbf4d05ebef3486510ae1c293d5f", "spentIndex": 0}], "fees": 1.51e-05, "size": 338, "confirmations": 5, "blockheight": 479121, "txid": "8b6db9b8ba24235d86b053ea2ccb484fc32b96f89c3c39f98d86f90db16076a0", "blockhash": "000000000000000004d736cdc6be7912951849d6a96e8118a5009373d51aa422", "blocktime": 1502563143, "valueOut": 0.0004849, "vin": [{"vout": 0, "n": 0, "valueSat": 50000, "doubleSpentTxID": null, "addr": "3LJVbFT3mKw46FMwQuDvUt5xFQBFsLkknn", "value": 0.0005, "sequence": 4294967294, "txid": "5f72ec264d961dfdd460a9cc22743c795127b129d40be8087244d93b3f7eee11", "scriptSig": {"asm": "0 3045022100e87e3ae6ac22ccbaa8a5800b2bbd81aad9ff56e0fc6993953635fd9ee85e49f1022049

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bcash_tx_bc37c28dfb467d2ecb50261387bf752a3977d7e5337915071bb4151e6b711a78.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1472
                                        Entropy (8bit):5.16997579741517
                                        Encrypted:false
                                        SSDEEP:24:YVNA5XaT2ZoS9COfeZF4yhl1BdgSPOnCUtJCrpDjlCWTmUtSj4qmUtSwk1neY:YJT2C7UinBdggXwJTgSIgSF
                                        MD5:F5F7FE7C16A3462A48D4443489B36CF5
                                        SHA1:7B641C5C80FE555E227027B405843CAAAA465ED6
                                        SHA-256:3F4E12FDAC7E408F5BDAF52EEA53B0751D3C3A534CD9E6C0D3246F1F05433FAD
                                        SHA-512:87A93F35C12216270D2E2772C5F5F9DD04E65E2F8C9C66FEFC605EA766FA2BDB18D954F46809AE2ABEAD119A6653CC7CCEA11C10EBD4D9012BF3CCCE2DACD01B
                                        Malicious:false
                                        Preview:{"vout": [{"scriptPubKey": {"type": "pubkeyhash", "asm": "OP_DUP OP_HASH160 de701ce12e576395c863e9377c76dd7efe0c55c1 OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["1MH9KKcvdCTY44xVDC2k3fjBbX5Cz29N1q"], "hex": "76a914de701ce12e576395c863e9377c76dd7efe0c55c188ac"}, "n": 0, "spentHeight": 478743, "value": "0.01995344", "spentTxId": "502e8577b237b0152843a416f8f1ab0c63321b1be7a8cad7bf5c5c216fcf062c", "spentIndex": 0}], "fees": 4.656e-05, "size": 192, "confirmations": 503, "blockheight": 478623, "txid": "bc37c28dfb467d2ecb50261387bf752a3977d7e5337915071bb4151e6b711a78", "blockhash": "000000000000000004cc670aab354e9593d789ec091d571f99fb4ad67ec865a2", "blocktime": 1501857558, "valueOut": 0.01995344, "vin": [{"vout": 1, "n": 0, "valueSat": 2000000, "doubleSpentTxID": null, "addr": "1DS6LVgFWZBGVin3y5B9emUxHtnuQetp9L", "value": 0.02, "sequence": 4294967295, "txid": "8d566ad80d5f1d3887d3acddb35b980641919e6efa7c3a3a78413e56f95ea516", "scriptSig": {"asm": "3045022100860b4c43649f86ee603c13791646af4736c

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bcash_tx_f68caf10df12d5b07a34601d88fa6856c6edcbf4d05ebef3486510ae1c293d5f.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2268
                                        Entropy (8bit):5.109000243989634
                                        Encrypted:false
                                        SSDEEP:48:YWLiqKmDdO1C2WHcgcHUZrVG1ZK+uZBe5rVG1ZK+uV6eP:fWwE1C2WHcHHqrVYvH5rVYvheP
                                        MD5:F7D8526E29FABE3A1285D411AB8896E0
                                        SHA1:CB7AF6389EFA5B8EDDA90CE46FDFCF4C42DE4C43
                                        SHA-256:4931DF379CF798B2CDA0AEF40808636E68CF15EAA0D5BF529D9D6C900C65A435
                                        SHA-512:6C3E2E26E198A0AF4C026FCA0875AF9236F5A37B35914550AB65F17D26EB9011F4397C97533D15CDE1B3EBE5017EB1D26A20792ECA42AA01C37FA5A072C95853
                                        Malicious:false
                                        Preview:{"version": 1, "fees": 4.9e-06, "valueIn": 0.0004849, "valueOut": 0.00048, "locktime": 0, "txid": "f68caf10df12d5b07a34601d88fa6856c6edcbf4d05ebef3486510ae1c293d5f", "size": 373, "time": 1502564873, "confirmations": 0, "blockheight": -1, "vout": [{"spentIndex": null, "n": 0, "spentHeight": null, "value": "0.00024000", "scriptPubKey": {"hex": "76a91400741952f6a6eab5394f366db5cc5a54b0c2429f88ac", "type": "pubkeyhash", "asm": "OP_DUP OP_HASH160 00741952f6a6eab5394f366db5cc5a54b0c2429f OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["113Q5hHQNQ3bc1RpPX6UNw4GAXstyeA3Dk"]}, "spentTxId": null}, {"spentIndex": 0, "n": 1, "spentHeight": -1, "value": "0.00024000", "scriptPubKey": {"hex": "a914756c06d7e77de3950a6124f026d8e1a2464b3ecf87", "type": "scripthash", "asm": "OP_HASH160 756c06d7e77de3950a6124f026d8e1a2464b3ecf OP_EQUAL", "addresses": ["3CPtPpL5mGAPdxUeUDfm2RNdWoSN9dKpXE"]}, "spentTxId": "db845018e2049b0d81fca81cfec585cde9a50bae81ae095d53ee86ffd5f8c99b"}], "vin": [{"sequence": 4294967295, "valu

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_gold_tx_25526bf06c76ad3082bba930cf627cdd5f1b3cd0b9907dd7ff1a07e14addc985.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1138
                                        Entropy (8bit):5.266045788316132
                                        Encrypted:false
                                        SSDEEP:24:Y7MlpeZgEVv3P9FhRnelR5sel22Zrh9qIxwgqvKIZcN8ZJxInenRw:Yg0v3pBemeA2ljRxwFvxl7w
                                        MD5:C0A65537E2D1226B9ADE8277BBBA3E20
                                        SHA1:F398CBD84987A4B813709D10B165A32307332007
                                        SHA-256:6959BAC4284CB9B4F6D14EDA6EFCC8D9E9FB623FEB689B5AAAD6DAEFDADA73BD
                                        SHA-512:A503F6063E545A0412AC6BFD4988DAB2C66AEA9551414D1467DF0101F612880FC76F6CE2EEC4322CDA121B70133A16254A9D24FA3C94E4025C18F59158DA208D
                                        Malicious:false
                                        Preview:{"txid": "25526bf06c76ad3082bba930cf627cdd5f1b3cd0b9907dd7ff1a07e14addc985", "version": 1, "locktime": 0, "vin": [{"coinbase": "03b4e407005a2d4e4f4d50212068747470733a2f2f6769746875622e636f6d2f6a6f7368756179616275742f7a2d6e6f6d70", "sequence": 4294967295, "n": 0}], "vout": [{"value": "12.52382934", "n": 0, "scriptPubKey": {"hex": "76a9140cb60a52559620e5de9a297612d49f55f7fd14ea88ac", "asm": "OP_DUP OP_HASH160 0cb60a52559620e5de9a297612d49f55f7fd14ea OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["GK18bp4UzC6wqYKKNLkaJ3hzQazTc3TWBw"], "type": "pubkeyhash"}, "spentTxId": null, "spentIndex": null, "spentHeight": null}, {"value": "0.00000000", "n": 1, "scriptPubKey": {"hex": "6a24aa21a9eddb3ac2bba12721c8db157ba6b522196093d3a27a8083591a2b785a230a1d254f", "asm": "OP_RETURN aa21a9eddb3ac2bba12721c8db157ba6b522196093d3a27a8083591a2b785a230a1d254f"}, "spentTxId": null, "spentIndex": null, "spentHeight": null}], "blockhash": "000000000b9f4d15e03603463f536b7b9da695580ae8b8bcdac5970195b586f4", "blockhei

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_gold_tx_db77c2461b840e6edbe7f9280043184a98e020d9795c1b65cb7cef2551a8fb18.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2134
                                        Entropy (8bit):5.112227801446302
                                        Encrypted:false
                                        SSDEEP:48:YEfJPPJzJW8eBO9TjfNTjjJW8cvr12WRl3Kn:rBZVPeB8TjlTjlPcJ2WRon
                                        MD5:26ECF15DAFE18BA40D5F79C05399C31D
                                        SHA1:3A89B6CCD0B8CBC6ACF1E39B1E572C4AF1D6B94B
                                        SHA-256:F0E729A973CCBF572F0690FF0FC51498C319C7C86CF4F19C37FE18D06CF560DB
                                        SHA-512:D385AF66E4B26458279F58F873D813F79B7A54FE7E73DD59DC45C6074BA17B0D3D4EA6F479081A4C7C114C3A4E78361A83CD284E174A06FF6CC73CCBF95598FA
                                        Malicious:false
                                        Preview:{"txid": "db77c2461b840e6edbe7f9280043184a98e020d9795c1b65cb7cef2551a8fb18", "version": 1, "locktime": 0, "vin": [{"txid": "52fb172f86926a89a16edf55bc9baec3929149b7cd2d2389be3c7d08d744d300", "vout": 1, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "4830450221008bff524a092086372a19b924f41fa7fa2a5523bf42a4801b9503fcdfff2094e8022000f223a032bd0d7fee31d5663cd5cf86b82533bda6871366d519a68deae1042341210222c6760cc54de6fd7f2a40207a13137d497c7cdb472376523700d8ea88275a96", "asm": "30450221008bff524a092086372a19b924f41fa7fa2a5523bf42a4801b9503fcdfff2094e8022000f223a032bd0d7fee31d5663cd5cf86b82533bda6871366d519a68deae10423[ALL|FORKID] 0222c6760cc54de6fd7f2a40207a13137d497c7cdb472376523700d8ea88275a96"}, "addr": "GgdFx96JSR3nbyhtgxqsUessZLarxLWA3J", "valueSat": 2128176, "value": "0.02128176", "doubleSpentTxID": null}, {"txid": "371eb4feaa4085b378bb825f3c1b457867c24211ee838584b1adac226bba654b", "vout": 0, "sequence": 4294967295, "n": 1, "scriptSig": {"hex": "47304402206aee1d853479782029755dd3c3

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_1570416eb4302cf52979afd5e6909e37d8fdd874301f7cc87e547e509cb1caa6.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1743
                                        Entropy (8bit):5.31554870261559
                                        Encrypted:false
                                        SSDEEP:24:YNVCdNww5F2ZNCdNE22u5k+2ZBCxBnlLsCxS7GpT8NyqzGpTvNy5uy0ClrUuf:YNVCwG2HCv72INsCQ6+ym6hy5uydrn
                                        MD5:376238DF160736D6ED70A5F768F63926
                                        SHA1:E75982C04D34105307A50954F2252E4D297AC08B
                                        SHA-256:D6169B5B04EE8CB9E33AFE7785793156CC79E902986C1170AD806322CD1DF4B1
                                        SHA-512:7C9DCD64E263FFA57DF818F026F231E2F69783FE182E3907CB05B355FD8DB23B85FA1BA2DAB9E6EEADA536DBBEC291447C4803EF49861F43BBC936E729AC93E2
                                        Malicious:false
                                        Preview:{"valueOut": 2.2016, "vout": [{"spentIndex": null, "spentHeight": null, "value": "1.00000000", "n": 0, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914b5089282a2e18305dbb01ee5e6c40b81993c96be88ac", "addresses": ["1HWDaLTpTCTtRWyWqZkzWx1wex5NKyncLW"], "asm": "OP_DUP OP_HASH160 b5089282a2e18305dbb01ee5e6c40b81993c96be OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": null, "spentHeight": null, "value": "1.20160000", "n": 1, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914d00f6606ddd5bfa271dd96848b9a682455af711e88ac", "addresses": ["1Ky7zozX19ULmzCLK7CGhX2BFj2moyUp5c"], "asm": "OP_DUP OP_HASH160 d00f6606ddd5bfa271dd96848b9a682455af711e OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "0000000000000000015e982463c967e1419784ef9da717344068bf7faaf9ab55", "valueIn": 2.2026, "fees": 0.001, "vin": [{"addr": "12vp7HFNua4VSjpswBhCfJJVhvqs8gkrUR", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 2.2026, "n": 0, "valueSat": 220260000, "txid

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_39a29e954977662ab3879c66fb251ef753e0912223a83d1dcb009111d28265e5.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2013
                                        Entropy (8bit):5.210033940318343
                                        Encrypted:false
                                        SSDEEP:48:Ym4E2J2RphYrJ2yaNpXllb8gwgQ/OVfgQKOVo6:WjJ2RpUJ2nNpXD9wgQufgQrv
                                        MD5:EF02F292588E0B6DA2A5C0CA59E7FBC1
                                        SHA1:6DC83D80B8072F89268F6BC9B6CCA86F8102EF1F
                                        SHA-256:999705A47A02503E121CB010E10801699B871E920C395D34ED2B5DD265001D4C
                                        SHA-512:7C21524C8ED47289BBD9581AA09DF15B566A3C3391F655A335E07964B1BC9582DAC97DA9B126673AAB1569992FE0800F8619F641A4525B7D533EC83F4D2E7A7A
                                        Malicious:false
                                        Preview:{"valueOut": 3.00986058, "vout": [{"spentIndex": 30, "spentHeight": 288729, "value": "2.98446058", "n": 0, "spentTxId": "6839c71b7d192a698b5388e9ea921805279cbc9f85bae1019d2f4fe7b326979a", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9149ef561f8f6fe602cba796137f2d56d7e8a0a4c8488ac", "addresses": ["1FVVioK1iE9X6cBZtarVj6e5vjMATc8izW"], "asm": "OP_DUP OP_HASH160 9ef561f8f6fe602cba796137f2d56d7e8a0a4c84 OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 1, "spentHeight": 284875, "value": "0.02540000", "n": 1, "spentTxId": "4a7b7e0403ae5607e473949cfa03f09f2cd8b0f404bf99ce10b7303d86280bf7", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914812c13d97f9159e54e326b481b8f88a73df8507a88ac", "addresses": ["1CmzyJp9w3NafXMSEFH4SLYUPAVCSUrrJ5"], "asm": "OP_DUP OP_HASH160 812c13d97f9159e54e326b481b8f88a73df8507a OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "00000000000000016732dadfc971c98b308d46283f0340c0ad9479fc65a28550", "valueIn": 3.00996058, "fees": 0.0001, "vin": [{"addr": "1M2Qq4P8bjXrbvEYic

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_4a7b7e0403ae5607e473949cfa03f09f2cd8b0f404bf99ce10b7303d86280bf7.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):42348
                                        Entropy (8bit):5.371395930873508
                                        Encrypted:false
                                        SSDEEP:384:WPxPzPZP/P5PDPxPHPBP4PdPlP5PJP9PlPBPhPdPiPXP7P7PfPXPDPzPPP3P6PJX:N2m
                                        MD5:3F2818F8A6A0DF3D37B765C2A4F1ED32
                                        SHA1:ACDA62BE0EF474C8C905E2BA74264C3B21822168
                                        SHA-256:87E4526FFA0D2D07D678AD789533C42BB352B2ADB046BA534776E57D18B86EFD
                                        SHA-512:ED64C3116AC6FA7F6C1907F97ACA895A167298021B46607337DB1A0CDB99CA8BC540D41AE3613B1F590A9C002524E874FE2D1CE3013F163E2EE63633011212C5
                                        Malicious:false
                                        Preview:{"txid": "4a7b7e0403ae5607e473949cfa03f09f2cd8b0f404bf99ce10b7303d86280bf7", "version": 1, "locktime": 0, "vin": [{"txid": "c63e24ed820c5851b60c54613fbc4bcb37df6cd49b4c96143e99580a472f79fb", "vout": 1, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "493046022100b0377607841d5c6ccac13193cb1e4ebd6ee2e5d64ea94701a96c27a79d2b965d022100b9cf65e0007fd0a96db67173cc331c8fd4bef9b6d644a2ae4cb9f7df74c2a265012103477b9f0f34ae85434ce795f0c5e1e90c9420e5b5fad084d7cce9a487b94a7902", "asm": "3046022100b0377607841d5c6ccac13193cb1e4ebd6ee2e5d64ea94701a96c27a79d2b965d022100b9cf65e0007fd0a96db67173cc331c8fd4bef9b6d644a2ae4cb9f7df74c2a265[ALL] 03477b9f0f34ae85434ce795f0c5e1e90c9420e5b5fad084d7cce9a487b94a7902"}, "addr": "1CmzyJp9w3NafXMSEFH4SLYUPAVCSUrrJ5", "valueSat": 100000, "value": "0.001", "doubleSpentTxID": null}, {"txid": "39a29e954977662ab3879c66fb251ef753e0912223a83d1dcb009111d28265e5", "vout": 1, "sequence": 4294967295, "n": 1, "scriptSig": {"hex": "483045022100f908166e800b80ac2f907a90a1807a2fb

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_50f6f1209ca92d7359564be803cb2c932cde7d370f7cee50fd1fad6790f6206d.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1878
                                        Entropy (8bit):5.2309675071719175
                                        Encrypted:false
                                        SSDEEP:48:YsZ2WKLBIT2nTEzjPuFEtxuF5tK9pYaaIs+w:b2LeT2wfPeAxeDK9qIs+w
                                        MD5:C928D75F3BA685DCA38A932DB607D854
                                        SHA1:D4E1206F78B837518065BF9D1058045AB7A425F8
                                        SHA-256:5DE49B0260A492F36345937D608607C678CA59AA276405FB5ED1E675E0E2FB18
                                        SHA-512:8C3870673C28F69E21CE7CE146AA6EFB5045FDC93F49A3B292A22D15718318FBC6CE31FFFB073492E0C4EAB815D2BACE2DA8D0346EC0DB588897D9BB5305B309
                                        Malicious:false
                                        Preview:{"fees": 0.000113, "blocktime": 1423664307, "vout": [{"n": 0, "spentTxId": "f003c5c041d0708026e20ce97733f4561fb8c52e302692ac2e550aabe6c3912f", "value": "0.00113698", "spentHeight": 350552, "spentIndex": 0, "scriptPubKey": {"asm": "OP_DUP OP_HASH160 902c642ba3a22f5c6cfa30a1790c133ddf15cc88 OP_EQUALVERIFY OP_CHECKSIG", "hex": "76a914902c642ba3a22f5c6cfa30a1790c133ddf15cc8888ac", "addresses": ["1E9KUz71DjP3rNk2Xibd1FwyHLWfbnhrCz"], "type": "pubkeyhash"}}, {"n": 1, "spentTxId": "c275c333fd1b36bef4af316226c66a8b3693fbfcc081a5e16a2ae5fcb09e92bf", "value": "0.00050000", "spentHeight": 344045, "spentIndex": 0, "scriptPubKey": {"asm": "OP_DUP OP_HASH160 a6450f1945831a81912616691e721b787383f4ed OP_EQUALVERIFY OP_CHECKSIG", "hex": "76a914a6450f1945831a81912616691e721b787383f4ed88ac", "addresses": ["1GA9u9TfCG7SWmKCveBumdA1TZpfom6ZdJ"], "type": "pubkeyhash"}}], "vin": [{"sequence": 4294967295, "addr": "15T9DSqc6wjkPxcr2MNVSzF9JAePdvS3n1", "n": 0, "vout": 0, "scriptSig": {"asm": "304402204ec6818b86

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_54aa5680dea781f45ebb536e53dffc526d68c0eb5c00547e323b2c32382dfba3.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2016
                                        Entropy (8bit):5.193835433186479
                                        Encrypted:false
                                        SSDEEP:48:YwTn1Mfa1D2pGLBDRQWLE2FhAUJgT8SLNH8xLNGPBuXX+s:J2pGLrLE2LAEgFcU/s
                                        MD5:C0421A06171C4A314D7818D3247708E0
                                        SHA1:CD84E267D83EB08C2E0BC46348EA6784A34DDF1A
                                        SHA-256:D7054FEE1F3829EFCFAC4C3AC6D2A8607595946F0DADA3C3B51193ADE6F5A031
                                        SHA-512:459A013A6263C97F0B92D1ACD7D7B1A635A972B310940D58B79DA7949E964648127DD6861202DBD0CF57B13DDEE42821BF3A0BC3D15B74E9E947B5BB28CDA273
                                        Malicious:false
                                        Preview:{"valueOut": 1.05472082, "vout": [{"spentIndex": 0, "spentHeight": 293754, "value": "1.05072082", "n": 0, "spentTxId": "b664fca5b225d3fc01d6f562488136adc4d563e52fdc639db8b6f50afaa5d736", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914486088128a2137cd53b81f3efe4c3d612b7a777f88ac", "addresses": ["17bhHwY6nhomv4RxwkEGRZ6VutKjoGMDSS"], "asm": "OP_DUP OP_HASH160 486088128a2137cd53b81f3efe4c3d612b7a777f OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 293786, "value": "0.00400000", "n": 1, "spentTxId": "8cc1f4adf7224ce855cf535a5104594a0004cb3b640d6714fdb00b9128832dd5", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91424a56db43cf6f2b02e838ea493f95d8d6047423188ac", "addresses": ["14LmW5k4ssUrtbAB4255zdqv3b4w1TuX9e"], "asm": "OP_DUP OP_HASH160 24a56db43cf6f2b02e838ea493f95d8d60474231 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "000000000000000092268fe69290d4150455aee141bfa0271c6948d18e56dfd0", "valueIn": 1.05482082, "fees": 0.0001, "vin": [{"addr": "13vPZWiYyXxX2MWZrzy

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_58497a7757224d1ff1941488d23087071103e5bf855f4c1c44e5c8d9d82ca46e.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1998
                                        Entropy (8bit):5.213712896268691
                                        Encrypted:false
                                        SSDEEP:24:YR62JiN2955h62ZTRNUWvWNX5yWH2ZBGlSvnOM8VWFGSK33Ppp5zFGSK33PWpvwi:Y82xJM2uW+NHH2GlSvOMi3y3kwEKYR
                                        MD5:0E420F80A7AAA938C9C95F134B485895
                                        SHA1:7522B9EE7E771C0E4D5DAC73B3B07DB4A2E2FB51
                                        SHA-256:B75930609237AA206CEEDA5952634B070141064A2B5FBAAB8E52B361713492F8
                                        SHA-512:B7B30F0A737A722C24E1D5E5E34A69D53BF6526B0198A0AE3E16A6B24C9E91FE12FBC4112CF17CE07E067E40B024410BD3396BE0A37D03B48FE2059FA6ABE318
                                        Malicious:false
                                        Preview:{"valueOut": 0.46995, "vout": [{"spentIndex": 28, "spentHeight": 288729, "value": "0.46885000", "n": 0, "spentTxId": "6839c71b7d192a698b5388e9ea921805279cbc9f85bae1019d2f4fe7b326979a", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91459581dcaf8ed947343b569f1fa2d855d0fc6d9bf88ac", "addresses": ["199QhWMtYE79AG3547QXmZpa8NtLDgme16"], "asm": "OP_DUP OP_HASH160 59581dcaf8ed947343b569f1fa2d855d0fc6d9bf OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 1, "spentHeight": 284865, "value": "0.00110000", "n": 1, "spentTxId": "c63e24ed820c5851b60c54613fbc4bcb37df6cd49b4c96143e99580a472f79fb", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9142db345c36563122e2fd0f5485fb7ea9bbf7cb5a288ac", "addresses": ["15AeAhtNJNKyowK8qPHwgpXkhsokzLtUpG"], "asm": "OP_DUP OP_HASH160 2db345c36563122e2fd0f5485fb7ea9bbf7cb5a2 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "00000000000000009ea3d77854af7c8cc0f28506dc8379c89830e445d951f4bf", "valueIn": 0.47005, "fees": 0.0001, "vin": [{"addr": "19UC6mkNJyqy3iKwQQyNm4TV

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_6189e3febb5a21cee8b725aa1ef04ffce7e609448446d3a8d6f483c634ef5315.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1854
                                        Entropy (8bit):5.21621821650514
                                        Encrypted:false
                                        SSDEEP:48:YXf79GCXMXK2pT1wl+yvQOlW54b/JQnirJQqilg+i:OzD2OXvQOlW8GnKGqLd
                                        MD5:FD28F430B4946788FBACBC0B8050DB87
                                        SHA1:1328B32D8004E8AD224B92DA62DEF56678C9D806
                                        SHA-256:874B05A1E78CF372E731F8B489FD3ABC1604C52B65B188B8DB7D9643111B9DE9
                                        SHA-512:29435858975967089E642D1248F392B05D098A68BA288ADF69C22AB20BA6160CB5D9FF0EFFE9D3320038909920FAEE4F5FE689F932393CCB4E6258BD98B3FA9D
                                        Malicious:false
                                        Preview:{"valueOut": 1.26511535, "vout": [{"spentIndex": 0, "spentHeight": 335022, "value": "1.26491535", "n": 0, "spentTxId": "79f47b5812eb8bcf13d4e60792129488ea237f86386468391d3ad3f8fdb3356e", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91495783804d28e528fbc4b48c7700471e6845804eb88ac", "addresses": ["1EdKhXv7zjGowPzgDQ4z1wa2ukVrXRXXkP"], "asm": "OP_DUP OP_HASH160 95783804d28e528fbc4b48c7700471e6845804eb OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 333744, "value": "0.00020000", "n": 1, "spentTxId": "dd320786d1f58c095be0509dc56b277b6de8f2fb5517f519c6e6708414e3300b", "scriptPubKey": {"type": "scripthash", "hex": "a914fb0670971091da8248b5c900c6515727a20e866287", "addresses": ["3QaKF8zobqcqY8aS6nxCD5ZYdiRfL3RCmU"], "asm": "OP_HASH160 fb0670971091da8248b5c900c6515727a20e8662 OP_EQUAL"}}], "blockhash": "0000000000000000149287bdefeecd34a7d0770ec5954f337c508bc07f980819", "valueIn": 1.26521535, "fees": 0.0001, "vin": [{"addr": "1AZjQHKxsUFQRR24qYTBAxMsQR9bgoRL4h", "vout": 0,

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_a6e2829d089cee47e481b1a753a53081b40738cc87e38f1d9b23ab57d9ad4396.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1787
                                        Entropy (8bit):5.206869121530489
                                        Encrypted:false
                                        SSDEEP:48:YfCcNQAD3mS7QAUCXBy2OhGumD9NFJ9Ns4Y3OQ:S7mSUCg2Ok9ud3b
                                        MD5:2028EEFB1A798FBBF132480119395695
                                        SHA1:DB4B4CE9BB82F8E40187EA40C759B7725EA4E8F6
                                        SHA-256:1FDE8C1724C5E83BF591F8DD756CDFCC08776CF99B72295981AA59A769AE998B
                                        SHA-512:A6635C52AC9CD0C3A4C8122B407FE442C2BB6E4D1C3B76BE95C12AD473B207002ADCF08AB96D1B184D94D89C3FBD4E3D7603E55C1BE4F8DD2A4A3B0E069BDC39
                                        Malicious:false
                                        Preview:{"valueOut": 0.02262478, "vout": [{"spentIndex": null, "spentHeight": null, "value": "0.00100000", "n": 0, "spentTxId": null, "scriptPubKey": {"type": "scripthash", "hex": "a914fe5b12d8eb22356e3e071ba80dabdf7272c1898787", "addresses": ["3QsvfB6d1LzYcpm8xyhS1N1HBRrzHTgLHB"], "asm": "OP_HASH160 fe5b12d8eb22356e3e071ba80dabdf7272c18987 OP_EQUAL"}}, {"spentIndex": 0, "spentHeight": 335144, "value": "0.02162478", "n": 1, "spentTxId": "e4bc1ae5e5007a08f2b3926fe11c66612e8f73c6b00c69c7027213b84d259be3", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914c3ddd5e35f9bbecd7b10f47b5734dbfe40e331cb88ac", "addresses": ["1JreWorDp4fm2tqPR9ntUXApyXUZPR7LSP"], "asm": "OP_DUP OP_HASH160 c3ddd5e35f9bbecd7b10f47b5734dbfe40e331cb OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "000000000000000000f2c3875e9e7998fee70fe9d3961900230fafa55201d375", "valueIn": 0.02272478, "fees": 0.0001, "vin": [{"addr": "1QFYUD8963xdqEQ1PU64t8391t148qQtbS", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.0

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_c6091adf4c0c23982a35899a6e58ae11e703eacd7954f588ed4b9cdefc4dba52.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1831
                                        Entropy (8bit):5.194246236233287
                                        Encrypted:false
                                        SSDEEP:24:YtB5NPJTIq8r5sJTw2ZgZU1Tjsux3ED1TT47kKO3T0xfEzMqYgkep1ePGVBFp1eb:Y7JKuJw2aClLGD67xKTifkMqYQYwYJ3p
                                        MD5:60822ADFD8B26584C216E0B57D02152A
                                        SHA1:1D91ECCFD1994C0F29A32EB880B347029F0B2F6E
                                        SHA-256:38DADFD3BEDA94B678DDE0C93A1B56606C3ADA14EABAC1B9A19F46A40A7EBCA5
                                        SHA-512:A72F514E8E792ED6F5CD2F629D044417457B1F9E5C3772636086827695E669871885BEE4158C5FF2AEF84054C4CAE9D2AF5FA55B7145780BF11BB4975FE004FC
                                        Malicious:false
                                        Preview:{"valueOut": 0.0999, "vout": [{"spentIndex": 1, "spentHeight": 311327, "value": "0.09890000", "n": 0, "spentTxId": "e8d445189c4158fb01f19514015f85dccc09a680be969f7a26fe74aabbc989f7", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9146970a648bb72eedba08c2d72eb47b8b704bf5ae388ac", "addresses": ["1AcWuArjpaRJBSYM8LpLk7mgcpEMbGxUNz"], "asm": "OP_DUP OP_HASH160 6970a648bb72eedba08c2d72eb47b8b704bf5ae3 OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 332795, "value": "0.00100000", "n": 1, "spentTxId": "8382a2b2e3ec8788800c1d46d285dfa9dd4051edddd75982fad166b9273e5ac6", "scriptPubKey": {"type": "scripthash", "hex": "a91488376dc8232dbafd959cba5b370be6629506cb1c87", "addresses": ["3E7GDtuHqnqPmDgwH59pVC7AvySiSkbibz"], "asm": "OP_HASH160 88376dc8232dbafd959cba5b370be6629506cb1c OP_EQUAL"}}], "blockhash": "00000000000000000e72b8fdd326aed038bc1e9ed80cdaf2732d62cd10dd2c4d", "valueIn": 0.1, "fees": 0.0001, "vin": [{"addr": "1En8Z9ekdEzdu5gur5f1G9gowv42tbBaSD", "vout": 0, "sequence":

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_c63e24ed820c5851b60c54613fbc4bcb37df6cd49b4c96143e99580a472f79fb.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2568
                                        Entropy (8bit):5.1658800730640015
                                        Encrypted:false
                                        SSDEEP:48:Ygt292C092mphYrJ2ha+hVPgkF4ARFnvtwEdmB+PBWl:A92C092mpUJ2M+hVISznvtwEI
                                        MD5:3B83F921459615780A63F1E07150C1A7
                                        SHA1:916055E6027D0AA44042086532FB8C4CC0559FE5
                                        SHA-256:599B1DEF3542DE5F11EE1AAFF8E4216B9576EF24B37B62D13031A6078DCB1C88
                                        SHA-512:7226438B28DB2C1AEE0B47B5D6158E649B337905DE8CCEF264E7C88A8F912F70002E81CEBE70E865719CC5BB740FC172DF77654E7E77E7C063AA6EDC0CCD1738
                                        Malicious:false
                                        Preview:{"valueOut": 0.002, "vout": [{"spentIndex": 29, "spentHeight": 288729, "value": "0.00100000", "n": 0, "spentTxId": "6839c71b7d192a698b5388e9ea921805279cbc9f85bae1019d2f4fe7b326979a", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9142f4490d5263906e4887ca2996b9e207af3e7824088ac", "addresses": ["15Jvu3nZNP7u2ipw2533Q9VVgEu2Lu9F2B"], "asm": "OP_DUP OP_HASH160 2f4490d5263906e4887ca2996b9e207af3e78240 OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 284875, "value": "0.00100000", "n": 1, "spentTxId": "4a7b7e0403ae5607e473949cfa03f09f2cd8b0f404bf99ce10b7303d86280bf7", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914812c13d97f9159e54e326b481b8f88a73df8507a88ac", "addresses": ["1CmzyJp9w3NafXMSEFH4SLYUPAVCSUrrJ5"], "asm": "OP_DUP OP_HASH160 812c13d97f9159e54e326b481b8f88a73df8507a OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "0000000000000000ad1b23698d40235f4bc71eb1ab6fa5891ade1fd89b0beb7e", "valueIn": 0.0021, "fees": 0.0001, "vin": [{"addr": "1CK7SJdcb8z9HuvVft3D91HLpLC

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_c6be22d34946593bcad1d2b013e12f74159e69574ffea21581dad115572e031c.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2008
                                        Entropy (8bit):5.193549517983418
                                        Encrypted:false
                                        SSDEEP:24:YWyo2JiN2955h62ZXN+IMhM5fx2ZBXcVgEHFayv1y0bTWp4KussfKTZsZ0QWJz8f:Y1o2xJM2G1hcx2MVHZoUjiBI
                                        MD5:D188B0D2FF9211CCC4ECA7E71E5BAF42
                                        SHA1:712DAF368594E91D37B826A419BCED128352F710
                                        SHA-256:808BB5D61CF08DB14EEE5CF3E239288626E17D4DEA1D9DB6A33B2F511D211C03
                                        SHA-512:EC8DC6F46A62E987F2575F2F83B61D80544CA95C59562C0839931328695D6E5A4CF115CECE8E6A6FD2E649D18CBFD815A3FE32763CCC5A03860FEAB36AC19980
                                        Malicious:false
                                        Preview:{"valueOut": 3.33165406, "vout": [{"spentIndex": 27, "spentHeight": 288729, "value": "3.33065406", "n": 0, "spentTxId": "6839c71b7d192a698b5388e9ea921805279cbc9f85bae1019d2f4fe7b326979a", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91459581dcaf8ed947343b569f1fa2d855d0fc6d9bf88ac", "addresses": ["199QhWMtYE79AG3547QXmZpa8NtLDgme16"], "asm": "OP_DUP OP_HASH160 59581dcaf8ed947343b569f1fa2d855d0fc6d9bf OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 284865, "value": "0.00100000", "n": 1, "spentTxId": "c63e24ed820c5851b60c54613fbc4bcb37df6cd49b4c96143e99580a472f79fb", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9140223b1a09138753c9cb0baf95a0a62c82711567a88ac", "addresses": ["1CK7SJdcb8z9HuvVft3D91HLpLC6KSsGb"], "asm": "OP_DUP OP_HASH160 0223b1a09138753c9cb0baf95a0a62c82711567a OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "0000000000000000371eecb3a4a9e2347cd8971b9a50a63ef2a7276c3a5e2ca7", "valueIn": 3.33175406, "fees": 0.0001, "vin": [{"addr": "1FSAF2vZ47XnyiF7Cuv

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_d1d08ea63255af4ad16b098e9885a252632086fa6be53301521d05253ce8a73d.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1789
                                        Entropy (8bit):5.2160500955448965
                                        Encrypted:false
                                        SSDEEP:48:Y/Cs85vJ8KA8L/6wV2U6QmBPjG276B27qpmGq:Ayv2U6RtG276B270pq
                                        MD5:AA428BE2A80833808F900139E530DC29
                                        SHA1:E4412293335DC34BC09A05D888B29A93E26B300F
                                        SHA-256:44BF0492F732F96A439A7FE16685437A28FB53846826268356E40A192695ED78
                                        SHA-512:2CFE453D093D23C90543348A4C59C06542051D28EFDD324DA8838C840376621317B327089D8553D7F0F4B97FE8A6D7251170A4119EF35D26EF664093F861FE9D
                                        Malicious:false
                                        Preview:{"valueOut": 0.1877507, "vout": [{"spentIndex": null, "spentHeight": null, "value": "0.00100000", "n": 0, "spentTxId": null, "scriptPubKey": {"type": "scripthash", "hex": "a914a4efc33d43d7a8a0040182c76ab624ff862f50d287", "addresses": ["3Gj7y1FdTppx2JEDqYqAEZFnKCA4GRysKF"], "asm": "OP_HASH160 a4efc33d43d7a8a0040182c76ab624ff862f50d2 OP_EQUAL"}}, {"spentIndex": 0, "spentHeight": 337674, "value": "0.18675070", "n": 1, "spentTxId": "1956152a945836ca835a04c0fbdbb1257bc9c24756f42c77dd1ed3c3fe1a94ac", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914167b282e46a22588d2746831f3dce2c37f6e70da88ac", "addresses": ["133sQKJfa4h55cwa5RcPAh5fmFA1SrELGJ"], "asm": "OP_DUP OP_HASH160 167b282e46a22588d2746831f3dce2c37f6e70da OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "0000000000000000177e78336482934c0f6826510464c5405490db118300dfab", "valueIn": 0.1878507, "fees": 0.0001, "vin": [{"addr": "12rApVsmCUHnPESfL3ycgTaQY7M6QrmY7j", "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.187

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_d5f65ee80147b4bcc70b75e4bbf2d7382021b871bd8867ef8fa525ef50864882.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2411
                                        Entropy (8bit):5.015299557946149
                                        Encrypted:false
                                        SSDEEP:48:Y0/aLBDRQWLE28wpGgbQqn/WnUYv4AyYs4AFYR2+:x/aLrLE28wpZxn/Wn74AG4A+X
                                        MD5:7069970CC313514AB3C03ECA38FDA1CF
                                        SHA1:C923B27ED377C8CD2A60BDC55702BB3FF7AAF363
                                        SHA-256:04BE231FBC959B3454114650BA90CF8E073C085593BD686F8D316D6BA6785503
                                        SHA-512:8782DFDB02B19C0FF47E4746E6EBA44B404DFC6B66FBD56703C76A89D2EFE0B56BEC43B2CE072393F1BDAF1399A99A632F55F2432F0FD7F0C831C2960B35F516
                                        Malicious:false
                                        Preview:{"valueOut": 0.0039, "vout": [{"spentIndex": 0, "spentHeight": 280227, "value": "0.00390000", "n": 0, "spentTxId": "fd79435246dee76b2f159d2db08032d666c95adc544de64c8c49f474df4a7fee", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91424a56db43cf6f2b02e838ea493f95d8d6047423188ac", "addresses": ["14LmW5k4ssUrtbAB4255zdqv3b4w1TuX9e"], "asm": "OP_DUP OP_HASH160 24a56db43cf6f2b02e838ea493f95d8d60474231 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "00000000000000011dec345ceae0765c98c72bdcb7cdd83e749ad37bbc3104cc", "valueIn": 0.004, "fees": 0.0001, "vin": [{"addr": "19qyPUSAXJ8cHw6TxZ6FYQFZdLMdJA7A2t", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.002, "n": 0, "valueSat": 200000, "txid": "c16a03f1cf8f99f6b5297ab614586cacec784c2d259af245909dedb0e39eddcf", "scriptSig": {"hex": "483045022072ba61305fe7cb542d142b8f3299a7b10f9ea61f6ffaab5dca8142601869d53c0221009a8027ed79eb3b9bc13577ac2853269323434558528c6b6a7e542be46e7e9a820141047a2d177c0f3626fc68c53610b0270fa6156181f4658

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_bitcoin_tx_e4bc1ae5e5007a08f2b3926fe11c66612e8f73c6b00c69c7027213b84d259be3.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1787
                                        Entropy (8bit):5.223993853654979
                                        Encrypted:false
                                        SSDEEP:48:Y2H2T1juY1D2eCeANE4ILoXqcY3DzpxNzfzpoNzhXB8Q:pHNS2ekE4ILo6x3ZxNzloNzhf
                                        MD5:06AEF6733A9DCB8F9ABA5E7410632DBF
                                        SHA1:3F8D8E8650CE3CE1C21DC66EB6C5424B916679A9
                                        SHA-256:EE0BEB9A223AA70E0DB4F62F8179B6549AF6CF0109F9BDD015A65F959FE3C9F6
                                        SHA-512:7A9A3F23BCA9E92E6CD6F75F00841FB130796C0FCA49F5097DC7C50FDCC515A19CD97C5D2BF0EBEF1CD9DA9264CDECB0FA3368CCD2909E4F3E853D2B401E3CF3
                                        Malicious:false
                                        Preview:{"valueOut": 0.02152478, "vout": [{"spentIndex": 0, "spentHeight": 338362, "value": "0.02052478", "n": 0, "spentTxId": "e8e0b3b3a10a5f7914abc7b6a0e6e6e35ec8944a81bb279701d5ce22c794d8fc", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914e6271f1394b1e25d976d0957cb2b36aeb1d875c588ac", "addresses": ["1MywHKjaict4ceqJ2SS414FtyfSgPDamn9"], "asm": "OP_DUP OP_HASH160 e6271f1394b1e25d976d0957cb2b36aeb1d875c5 OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": null, "spentHeight": null, "value": "0.00100000", "n": 1, "spentTxId": null, "scriptPubKey": {"type": "scripthash", "hex": "a9143e03a6446f27e2a0c1366b375a275c758e21edfa87", "addresses": ["37LvC1Q5CyKbMbKMncEJdXxqGhHxrBEgPE"], "asm": "OP_HASH160 3e03a6446f27e2a0c1366b375a275c758e21edfa OP_EQUAL"}}], "blockhash": "000000000000000000f2c3875e9e7998fee70fe9d3961900230fafa55201d375", "valueIn": 0.02162478, "fees": 0.0001, "vin": [{"addr": "1JreWorDp4fm2tqPR9ntUXApyXUZPR7LSP", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.0

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_decred_testnet_tx_16da185052740d85a630e79c140558215b64e26c500212b90e16b55d13ca06a8.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1829
                                        Entropy (8bit):5.236233983638887
                                        Encrypted:false
                                        SSDEEP:24:Y7MujMngzt8RE0jjFXCW3hKk9tDg+vy9hKk9tDg+qyLHrhBjpHjlZW5MGlklZW55:Y7jMFG0XcCOcC9HrLj7pL2sexyhxO
                                        MD5:ED5D45EDEAAD24BDF7A90176FCCF8DA8
                                        SHA1:8198BB76ADE2EE2D6D2AD33AD4F900C67F598DA7
                                        SHA-256:342673D54684E3F3BADCCAF59131E60C7935102F33F0D7C4D0E1321A07941241
                                        SHA-512:33905B9871F668267A41E072292799F63CFDA3B55E880E00329DAE3E20C978AE245AC550F5F067787F93102E2E651CECCB6CB4CA61F835784D359B6A8EF1C7EE
                                        Malicious:false
                                        Preview:{"txid": "16da185052740d85a630e79c140558215b64e26c500212b90e16b55d13ca06a8", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "157b2c4740d22f9c1ab6e21f267159e453abad418e5d686730c33d926978380c", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "5.71370733", "blockheight": 199736, "blockindex": 0, "scriptSig": {"asm": "3044022064b5d90720e600a30df2206456ab5d8dc8b15fb9ca368f459c8818163bc0811b0220337225cd791d137de24cf147c14ea3e24d627a894480a031f372291e2a7c802801 02c72f904e641e92db3df2100bcfb79dca731c2f27cf71d43dc8904744ca4d2e0b", "hex": "473044022064b5d90720e600a30df2206456ab5d8dc8b15fb9ca368f459c8818163bc0811b0220337225cd791d137de24cf147c14ea3e24d627a894480a031f372291e2a7c8028012102c72f904e641e92db3df2100bcfb79dca731c2f27cf71d43dc8904744ca4d2e0b"}, "n": 0, "addr": "TsexEoyMS79mFwmAJdi33X7n7dffG5J6wd5", "valueSat": 571370733, "value": "5.71370733", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 97, "unconfirmedInput": false}], "vout": [{"value": "2.0000000

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_decred_testnet_tx_3f7c395521d38387e7617565fe17628723ef6635a08537ad9c46cfb1619e4c3f.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1833
                                        Entropy (8bit):5.243253136344625
                                        Encrypted:false
                                        SSDEEP:48:YEw04vKUHwUHmHrCkjQ4NT2fttB9fcSyqNAg:pw04yVPHrzT2jcSyu
                                        MD5:F7C51D619E667AEB12DD9F1BD5EF368B
                                        SHA1:79630C379905F54E3C0E707DA4E079D2C4DC99D5
                                        SHA-256:7D66C40CFD86D268538ACBBAD7D58EE777425A4BD04B9B5513F48E0B92A03DC6
                                        SHA-512:7BEA3F57FFEC5B9620B7388E6FAABEAB8B29CD10913AB572BC1C4FD09395B6069457769D5EF090389E5C4F40BC4BB5A8B3B46D911C8E6A114A5A33BA55F95937
                                        Malicious:false
                                        Preview:{"txid": "3f7c395521d38387e7617565fe17628723ef6635a08537ad9c46cfb1619e4c3f", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "0e12c16e0e18eab7b14c28f8273588803fad511aaad3c24d5cdc5a2e5556bc05", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "3.42822438", "blockheight": 199752, "blockindex": 0, "scriptSig": {"asm": "3045022100ee07ae6d21a13fbc151e3d5381eaafd1976315020e68676d664ccedea38c78740220396dd0de4f8fd905bb1c944f39ff3af97479a5cb834fa7776680eb264fae749501 02c72f904e641e92db3df2100bcfb79dca731c2f27cf71d43dc8904744ca4d2e0b", "hex": "483045022100ee07ae6d21a13fbc151e3d5381eaafd1976315020e68676d664ccedea38c78740220396dd0de4f8fd905bb1c944f39ff3af97479a5cb834fa7776680eb264fae7495012102c72f904e641e92db3df2100bcfb79dca731c2f27cf71d43dc8904744ca4d2e0b"}, "n": 0, "addr": "TsexEoyMS79mFwmAJdi33X7n7dffG5J6wd5", "valueSat": 342822438, "value": "3.42822438", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 81, "unconfirmedInput": false}], "vout": [{"value": "1.427

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_decred_testnet_tx_5e6e3500a333c53c02f523db5f1a9b17538a8850b4c2c24ecb9b7ba48059b970.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1509
                                        Entropy (8bit):5.195923662479774
                                        Encrypted:false
                                        SSDEEP:24:Y7MjOigzKcoUs0FyHCWuQVeAhIQVeAgsTLjfHJlZW5L1aa2Zbl1a9NaTDcivITrn:Y5oUs0oY2e2/jIsa2Xs8vWrn
                                        MD5:2577CB1026B83A2D8D4EB11ABA94D088
                                        SHA1:3552312252FC0F8E5CAA7461BB383B78EE99E6EF
                                        SHA-256:5949881A3EB54D1900FD28F2B240C2A18C205732894A3680E96F1E382805C606
                                        SHA-512:692CD45501866769F28ADA77EDCA07C20D953CD88418A573BA50041293BEADD8872A60465BBA34A099E6F4A5BF81981848A27CBD302A3B74D2C4A609B2B36D04
                                        Malicious:false
                                        Preview:{"txid": "5e6e3500a333c53c02f523db5f1a9b17538a8850b4c2c24ecb9b7ba48059b970", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "e16248f0b39a0a0c0e53d6f2f84c2a944f0d50e017a82701e8e02e46e979d5ed", "vout": 1, "tree": 0, "sequence": 4294967295, "amountin": 2, "blockheight": 192676, "blockindex": 1, "scriptSig": {"asm": "3045022100bad68486491e449a731513805c129201d7f65601d6f07c97fda0588453c97d22022013e9ef59657ae4f344ac4f0db2b7a23dbfcdb51ebeb85277146ac189e547d3f701 02f5a745afb96077c071e4d19911a5d3d024faa1314ee8688bc6eec39751d0818f", "hex": "483045022100bad68486491e449a731513805c129201d7f65601d6f07c97fda0588453c97d22022013e9ef59657ae4f344ac4f0db2b7a23dbfcdb51ebeb85277146ac189e547d3f7012102f5a745afb96077c071e4d19911a5d3d024faa1314ee8688bc6eec39751d0818f"}, "n": 0, "addr": "TscqTv1he8MZrV321SfRghw7LFBCJDKB3oz", "valueSat": 200000000, "value": 2, "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 6387, "unconfirmedInput": false}], "vout": [{"value": "1.90000000", "n": 0, "ver

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_decred_testnet_tx_ccf95b0fd220ef59ae2e5b17005a81e222758122682d522eff8ae1fcbc93bc74.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1865
                                        Entropy (8bit):5.276277826643442
                                        Encrypted:false
                                        SSDEEP:24:Y7MrEvgzBT+k6s0NfTXCWT21DFbKO21DFb1/5jzHRlZW5D2Z4pNL5lZW5L1aa2Zp:YOTd6s0b2xZKO2xZ1RjY2Nsa2Xsg4b+
                                        MD5:4EF2B9B53E792AB97E944F8B4DF670FC
                                        SHA1:CE9FE3E3170268C8B2ED8822F4F3B656F71DE5C9
                                        SHA-256:EEF6B907580DD294C7D306E0F007AB1C6AD25A6DD2462A271F247456486B1AD4
                                        SHA-512:FFFF8FF777EC90BF12AA715AE14AFB8D80F2195A3E38CE2F45A457C3F485F0B22922D4EE9EDCE989E20493F0502C1919960D23FEA06DCAAF29AEC6584B6DB6F5
                                        Malicious:false
                                        Preview:{"txid": "ccf95b0fd220ef59ae2e5b17005a81e222758122682d522eff8ae1fcbc93bc74", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "bcc56f8b646c787d505275a7ab174fb060b028dcc4469e9a4d8391224fe67515", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "4.86000277", "blockheight": 186396, "blockindex": 0, "scriptSig": {"asm": "304502210094eb39bdfaa3236cf211c8249cf82603c0b7275dc59dc7b27936806e20a063b90220691aa71e9a0ab246a1dc4568c0ad4b5202d35ed0639fe64da17085701303e21801 02ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675", "hex": "48304502210094eb39bdfaa3236cf211c8249cf82603c0b7275dc59dc7b27936806e20a063b90220691aa71e9a0ab246a1dc4568c0ad4b5202d35ed0639fe64da17085701303e218012102ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675"}, "n": 0, "addr": "TseH9wPe4bfRqS2qwceAyjzNGFrMAPgzkvB", "valueSat": 486000277, "value": "4.86000277", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 12667, "unconfirmedInput": false}], "vout": [{"value": "2.

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_decred_testnet_tx_e16248f0b39a0a0c0e53d6f2f84c2a944f0d50e017a82701e8e02e46e979d5ed.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1974
                                        Entropy (8bit):5.264708001562207
                                        Encrypted:false
                                        SSDEEP:48:YZoUCHH04gwSl/DTl+6YBjD2Psa2Xsk+yxl:04n04gLtvYBH2Ea28k+gl
                                        MD5:D28F8311CF0183619DD027F5AAC9EC52
                                        SHA1:D6A7177F5CA8A68ADC7468709D464ADAA308CB4E
                                        SHA-256:C9673ACF611E0313967B014E89DCD4239EA71AA7C5519E8C7D31F076C4ABE25A
                                        SHA-512:BDDC227F1D7C56CC9B357E83DDC2419D6FCFD73C93C673AD2DE30738FD8CED67F7DCDF4E63D15B638E3264A8E229BED44D2FB9E0B502C24721E3289DCB6F83DA
                                        Malicious:false
                                        Preview:{"txid": "e16248f0b39a0a0c0e53d6f2f84c2a944f0d50e017a82701e8e02e46e979d5ed", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "21012b08c5077036460e8f75bbc57beb11d7bc30e7ad224ad5e67d15bd086500", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "3.53210301", "blockheight": 192566, "blockindex": 0, "scriptSig": {"asm": "304402207d127d59a44187952d9d0de94ad34a19dd9a84beb124fd8a3fb439c862544d3202206618f321385c30bda96fb01ce03f70a269d78a301c0b0c2e3e3689dfae3f473301 02ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675", "hex": "47304402207d127d59a44187952d9d0de94ad34a19dd9a84beb124fd8a3fb439c862544d3202206618f321385c30bda96fb01ce03f70a269d78a301c0b0c2e3e3689dfae3f4733012102ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675"}, "n": 0, "addr": "TseH9wPe4bfRqS2qwceAyjzNGFrMAPgzkvB", "valueSat": 353210301, "value": "3.53210301", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 5745, "unconfirmedInput": false}], "vout": [{"value": "1.53185

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_decred_testnet_tx_f395ef3e72a831a766db15e7a38bc28025d4ee02234d68bdea2d8353b47a3113.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1860
                                        Entropy (8bit):5.289824419731842
                                        Encrypted:false
                                        SSDEEP:48:Y6uKZntSZC0ZYta7YtlxjwZ32/gO152kkAgRMSW/w:IOyC0Ie32/F52kkaw
                                        MD5:EABA0AD56C716EC4D1E9F30EE56080D7
                                        SHA1:34FB4806960061CBDA0252DB4394985FB927DC64
                                        SHA-256:BB3C477FA38134064C9E65609471742C91FD3D05FF331F6FC3EE5A601EB470F5
                                        SHA-512:AA0A01125337860345679DACD64400FE1EFF9B49A55CB386226F3538421867866C7AEA4FFC5C47924EE2C9327C1B115CEC6A58E1B9DB2A19F31F3C1572771CC6
                                        Malicious:false
                                        Preview:{"txid": "f395ef3e72a831a766db15e7a38bc28025d4ee02234d68bdea2d8353b47a3113", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "e1b86d7694cf3bf9c83188bdb380892b85cd82a31410b09e267a745caaab7715", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "6.18712631", "blockheight": 184001, "blockindex": 0, "scriptSig": {"asm": "304402205de1a5bd40d551f77cd2a60d58767f92baa265ec99808ad14afe571682498e9b022054d148cd29d287e3e22d700b99e6a30823a9584a5db5e4ba26f4e60f613b4cc901 02ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675", "hex": "47304402205de1a5bd40d551f77cd2a60d58767f92baa265ec99808ad14afe571682498e9b022054d148cd29d287e3e22d700b99e6a30823a9584a5db5e4ba26f4e60f613b4cc9012102ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675"}, "n": 0, "addr": "TseH9wPe4bfRqS2qwceAyjzNGFrMAPgzkvB", "valueSat": 618712631, "value": "6.18712631", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 15062, "unconfirmedInput": false}], "vout": [{"value": "2.0000

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_09144602765ce3dd8f4329445b20e3684e948709c5cdcaf12da3bb079c99448a.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1397
                                        Entropy (8bit):5.147066625408129
                                        Encrypted:false
                                        SSDEEP:24:YrQa8lMkVU2er+9nQU2eLrGlM8v9T3cstX4L644LunOsWo8N+D+GUn:YMFMnwX6l/lT3fU0onQn
                                        MD5:BD3EDEA1C6869561288E5DD25DF0A607
                                        SHA1:EBBFF10AD7C8AB1DA951E5E56DED97ADB8C16876
                                        SHA-256:6274F1DE3BAAD47AAC48E0331DFDBF9A1BAA2EE19F31E2B9F0098A9ED76AF701
                                        SHA-512:2256BB34DADC1688B2DCB59C440B7E3CCE151EDB3934651CF3C114C46E446FF3986815AAC8A14CC4A54D71046C52FACFFA5DBEFD4B969BEDB08BE225B6AA52F4
                                        Malicious:false
                                        Preview:{"valueOut": 1.23445789, "vout": [{"spentIndex": 0, "spentHeight": 1063388, "value": "0.12300000", "n": 0, "spentTxId": "65b811d3eca0fe6915d9f2d77c86c5a7f19bf66b1b1253c2c51cb4ae5f0c017b", "scriptPubKey": {"hex": "00140099a7ecbd938ed1839f5f6bf6d50933c6db9d5c", "asm": "0 0099a7ecbd938ed1839f5f6bf6d50933c6db9d5c"}}, {"spentIndex": 0, "spentHeight": 1063500, "value": "1.11145789", "n": 1, "spentTxId": "0e480a97c7a545c85e101a2f13c9af0e115d43734e1448f0cac3e55fe8e7399d", "scriptPubKey": {"type": "scripthash", "hex": "a91458b53ea7f832e8f096e896b8713a8c6df0e892ca87", "addresses": ["2N1LGaGg836mqSQqiuUBLfcyGBhyZbremDX"], "asm": "OP_HASH160 58b53ea7f832e8f096e896b8713a8c6df0e892ca OP_EQUAL"}}], "blockhash": "00000000c55ba0613303aa56e7381aa03236cd7f2ab63eb4b8ff4658f8ec2180", "valueIn": 1.23456789, "fees": 0.00011, "vin": [{"addr": "2N1LGaGg836mqSQqiuUBLfcyGBhyZbremDX", "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 1.23456789, "n": 0, "valueSat": 123456789, "txid": "20912f98e

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_16c6c8471b8db7a628f2b2bb86bfeefae1766463ce8692438c7fd3fce3f43ce5.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1792
                                        Entropy (8bit):5.224493432883447
                                        Encrypted:false
                                        SSDEEP:48:Y7B6XI8WvbAWvaOI21AKnKcKSoWRcv0O4O0:QywA5OI21ASoWRO50
                                        MD5:940DBDBB4E50CF164288129B4D31ED2E
                                        SHA1:88F4B27B13D89002AF360DDAD6CC941D04E370F4
                                        SHA-256:3EE7A1479CEA97DF72A13D103EF4FFDD63795D9209470E8AEFE2E8A7B6F477BC
                                        SHA-512:3D77FADD3D4B75A0D453901946B2E102C99786CDA8A1CAC4CCA6498A7838CDE45409A908018D5D668BD5FE38D6F64C5547F4535225F3CCB6AFD9D5856696F187
                                        Malicious:false
                                        Preview:{"txid": "16c6c8471b8db7a628f2b2bb86bfeefae1766463ce8692438c7fd3fce3f43ce5", "version": 1, "locktime": 0, "vin": [{"txid": "3143f555a21753fbf3f095e27823122c4107393bb388aca736bd613e91192be4", "vout": 1, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "483045022100a2d3237b16795b10b33c19651261f9b9d1f8a0143f87f749adcc84e3d0b8f38702205ab3f80431af41091a01c946586b68fc843c8341738656cea70e25b0d0be2c970121024e6f7ddfe8c050649c7d3291f07e188c3fe779fb71954f8d00eaf1eff9af958e", "asm": "3045022100a2d3237b16795b10b33c19651261f9b9d1f8a0143f87f749adcc84e3d0b8f38702205ab3f80431af41091a01c946586b68fc843c8341738656cea70e25b0d0be2c97[ALL] 024e6f7ddfe8c050649c7d3291f07e188c3fe779fb71954f8d00eaf1eff9af958e"}, "addr": "mso9GMbZncQ767FQhkuMK8n4L4uQxDTFAA", "valueSat": 277569531, "value": 2.77569531, "doubleSpentTxID": null}], "vout": [{"value": "2.27568531", "n": 0, "scriptPubKey": {"hex": "76a9140889daec397047b8c6cce0080ba6c5455b443a8188ac", "asm": "OP_DUP OP_HASH160 0889daec397047b8c6cce0080ba6c5455b443a8

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_20912f98ea3ed849042efed0fdac8cb4fc301961c5988cba56902d8ffb61c337.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1787
                                        Entropy (8bit):5.258847704506951
                                        Encrypted:false
                                        SSDEEP:24:YLOsWo7U2er+9nQU2eLUCdNUZTa53Zu2ZBGlMO31hwIc2ONikH2ciHbEA3HONikW:YL0oGwXUCUuo2Glt31vrEOr7J6I
                                        MD5:972B8FF01FF2E7B05A038B88C84B5F31
                                        SHA1:561249E73E72FC49D9E9BD8F74ACBDBE202A4438
                                        SHA-256:BE3B35BB3F3DB92F93D7D33EA5CFCB8353404B321493A0AEC859E417B76F57C8
                                        SHA-512:B5A1B5F2FD84E1FCBB2DFBF9FF87613D4257DB17DE7E0C215775E39D0A72CD32B0050AF6B2B00F2879CAA1D036B9F33EB9D0F742ADE4BEB18AD7F09C91CA7FFF
                                        Malicious:false
                                        Preview:{"valueOut": 9.88976097, "vout": [{"spentIndex": 0, "spentHeight": 1063386, "value": "1.23456789", "n": 0, "spentTxId": "09144602765ce3dd8f4329445b20e3684e948709c5cdcaf12da3bb079c99448a", "scriptPubKey": {"type": "scripthash", "hex": "a91458b53ea7f832e8f096e896b8713a8c6df0e892ca87", "addresses": ["2N1LGaGg836mqSQqiuUBLfcyGBhyZbremDX"], "asm": "OP_HASH160 58b53ea7f832e8f096e896b8713a8c6df0e892ca OP_EQUAL"}}, {"spentIndex": null, "spentHeight": null, "value": "8.65519308", "n": 1, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914b84bacdcd8f4cc59274a5bfb73f804ca10f7fd1488ac", "addresses": ["mxKRHMmxvjY7RmZR4CJXPfGWpF6cMQEiM5"], "asm": "OP_DUP OP_HASH160 b84bacdcd8f4cc59274a5bfb73f804ca10f7fd14 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "00000000c55ba0613303aa56e7381aa03236cd7f2ab63eb4b8ff4658f8ec2180", "valueIn": 9.8899, "fees": 0.00013903, "vin": [{"addr": "n173UNnYvJQ7tZFNmQqgchKgSZY5scpxNw", "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 9

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_31bc1c88ce6ae337a6b3057a16d5bad0b561ad1dfc047d0a7fbb8814668f91e5.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):980
                                        Entropy (8bit):5.166168212444558
                                        Encrypted:false
                                        SSDEEP:24:YlTJv/XeqACegmlVoNT7L+F+F8T7L4AnTcFxVQY9F07SsZ+eS8Mo:Ylsaf8kAnT0VQY9F+1keF
                                        MD5:9820B34134E0FF9E5E147554CB00952A
                                        SHA1:EFE8DD0C1F64D271990BDEFA14132150D363F5DC
                                        SHA-256:437B0B9FC14A0080411BD971C8E26E8D845202C70BD9253BA6EDD3D977AFA47C
                                        SHA-512:0E7EB0A6B9F7345E6689C597EDFCDC34E38A7588E051226E14BC55D4868D8AACA6485392534D57ADBDF63FC36BEA7DE0EB3543684B259ABAB56CC92C245F3D72
                                        Malicious:false
                                        Preview:{"valueOut": 0.01603, "vout": [{"spentIndex": 0, "spentHeight": 1112864, "value": "0.01603000", "n": 0, "spentTxId": "c0bf56060a109624b4635222696d94a7d533cacea1b3f8245417a4348c045829", "scriptPubKey": {"type": "scripthash", "hex": "a914a8655acf68f785125561158b0f4db9b5d004404787", "addresses": ["2N8bcvm7XKX64fXnwRErbH4jgZSfBvQAzQp"], "asm": "OP_HASH160 a8655acf68f785125561158b0f4db9b5d0044047 OP_EQUAL"}}], "blockhash": "0000000000004cfcd096863f3f9a749907c0cc160446e17cdae2863735ba2fe9", "valueIn": 0.01604, "fees": 1e-05, "vin": [{"addr": null, "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.01604, "n": 0, "valueSat": 1604000, "txid": "c9348040bbc2024e12dcb4a0b4806b0398646b91acf314da028c3f03dd0179fc", "scriptSig": {"hex": "", "asm": null}}], "txid": "31bc1c88ce6ae337a6b3057a16d5bad0b561ad1dfc047d0a7fbb8814668f91e5", "blocktime": 1490794732, "version": 1, "confirmations": 8736, "time": 1490794732, "blockheight": 1112862, "locktime": 0, "size": 83}

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_65b811d3eca0fe6915d9f2d77c86c5a7f19bf66b1b1253c2c51cb4ae5f0c017b.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1262
                                        Entropy (8bit):5.118529297121093
                                        Encrypted:false
                                        SSDEEP:24:Y/WE2vieeAtd5MkE4L6Wk4LuJR7W+FYnOsWouy2m+lfwn:Y/Wh6eeid5MYV+Yn0otEdm
                                        MD5:5C5A07233E3130B0D93A706CB488BD33
                                        SHA1:21100F4D3E39CB0B45F2669772FAD7673C286547
                                        SHA-256:520BC64480F16E4F59676068A09ED33A21CD3BD6BA78089B648FCAC9AA6E95F0
                                        SHA-512:3ECCD89548DE5035983637DEBC6E608B6D581C0601C8062835DCBA5577AD4BD573850709C1354B4EF58B67A9FD95481B853A6ECF41D847D6844C15B9FCE2C2B9
                                        Malicious:false
                                        Preview:{"valueOut": 0.12289, "vout": [{"spentIndex": 0, "spentHeight": 1117152, "value": "0.05000000", "n": 0, "spentTxId": "0003c7cd0951f40acb2b7d9de20f87730971f9c6378012c8d3f94a0b56c57ab3", "scriptPubKey": {"type": "scripthash", "hex": "a9147a55d61848e77ca266e79a39bfc85c580a6426c987", "addresses": ["2N4Q5FhU2497BryFfUgbqkAJE87aKHUhXMp"], "asm": "OP_HASH160 7a55d61848e77ca266e79a39bfc85c580a6426c9 OP_EQUAL"}}, {"spentIndex": 1, "spentHeight": 1063500, "value": "0.07289000", "n": 1, "spentTxId": "0e480a97c7a545c85e101a2f13c9af0e115d43734e1448f0cac3e55fe8e7399d", "scriptPubKey": {"hex": "0014d16b8c0680c61fc6ed2e407455715055e41052f5", "asm": "0 d16b8c0680c61fc6ed2e407455715055e41052f5"}}], "blockhash": "000000005e99726b20f3909411cef2d67f7fe489e53df5ebb1358671076bebfa", "valueIn": 0.123, "fees": 0.00011, "vin": [{"addr": null, "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.123, "n": 0, "valueSat": 12300000, "txid": "09144602765ce3dd8f4329445b20e3684e948709c5cdcaf12da3bb07

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_6f90f3c7cbec2258b0971056ef3fe34128dbde30daa9c0639a898f9977299d54.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2515
                                        Entropy (8bit):5.18341209273868
                                        Encrypted:false
                                        SSDEEP:48:Yn7WOeT2SCAL6wLE26Yp6ZEHHEozPwvBEozPwvJmqlwEXwp0C:VT2SpL6wLE26esqzI5zIRtC
                                        MD5:15007251A08EFD6CB491ECC76ADC55EC
                                        SHA1:24A10071A74DF07044F2146DF416CF625C1C728D
                                        SHA-256:532AF35EE11DBBEC87FB94D810FB8D50CDA6F2BEC40DD09C925A297C8F2645C6
                                        SHA-512:A13FA6793EDDEDFC472596DE4A3C4A5C7EC76CF16FA966C81E0467C1F06B1BF0BE3446B1BF9E6E1C342DD07789D7D584583C2F3F33B5B69CB8739EDC71297A3D
                                        Malicious:false
                                        Preview:{"valueOut": 14.03850989, "vout": [{"spentIndex": 0, "spentHeight": 203911, "value": "4.03850989", "n": 0, "spentTxId": "5170fe1f25a05e1c9e125c27cd09e11f7c79c41409bc5b68f0e6f056af2d56b0", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914f5a05c2664b40d3116b1c5086c9ba38ed15b742e88ac", "addresses": ["n3uhx4JymCrWKX3e9i59YdJivMghF1bKZ4"], "asm": "OP_DUP OP_HASH160 f5a05c2664b40d3116b1c5086c9ba38ed15b742e OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": null, "spentHeight": null, "value": "10.00000000", "n": 1, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91424a56db43cf6f2b02e838ea493f95d8d6047423188ac", "addresses": ["mirio8q3gtv7fhdnmb3TpZ4EuafdzSs7zL"], "asm": "OP_DUP OP_HASH160 24a56db43cf6f2b02e838ea493f95d8d60474231 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "000000006656e1d72a211b7f469dd85209ba85c54127957a95591712a63d3848", "valueIn": 14.03850989, "fees": 0, "vin": [{"addr": "mnsfHtywp6AVUzgqu9P4tay6iQYY3WhCpz", "vout": 1, "sequence": 4294967295, "doubleSpe

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_9c31922be756c06d02167656465c8dc83bb553bf386a3f478ae65b5c021002be.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:modified
                                        Size (bytes):1790
                                        Entropy (8bit):5.233079132851722
                                        Encrypted:false
                                        SSDEEP:48:YGQCf89Y2AHGKx95XDf2TwlTjc1jNPljFHV:wG8y2AHGKL5XDuTwFjc1jNdZV
                                        MD5:59C0DCA43DE4E6AD2B2BB3C8B3BD4FD4
                                        SHA1:25953C37DAB5FCF2B3C305A74EB3ECE4CD7A0F18
                                        SHA-256:D1458AAABA4D8CBFA3850A8639CF9F11C786A6062971478EF694AD9E63DB4D24
                                        SHA-512:D2D80AC4C628A0DFC37E8E73F2AEAF19B7AF4C57681292C3AF96B5368FB130808FA1D58F77F22ABED8F5D5BAB17758965F73C22458CB8D5E3EE4C2BAD3C3EDF9
                                        Malicious:false
                                        Preview:{"valueOut": 0.135346, "vout": [{"spentIndex": null, "spentHeight": null, "value": "0.11924164", "n": 0, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914b6fc54e2f7c490ba20c686f532bfb02230656dbf88ac", "addresses": ["mxCVZGoYAmscorbmaaPjRHrRUMHihGmex5"], "asm": "OP_DUP OP_HASH160 b6fc54e2f7c490ba20c686f532bfb02230656dbf OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 897194, "value": "0.01610436", "n": 1, "spentTxId": "f41cbedd8becee05a830f418d13aa665125464547db5c7a6cd28f21639fe1228", "scriptPubKey": {"type": "scripthash", "hex": "a91463ff81a0110ab929bd1d44befa32b081839bbece87", "addresses": ["2N2MxyAfifVhb3AMagisxaj3uij8bfXqf4Y"], "asm": "OP_HASH160 63ff81a0110ab929bd1d44befa32b081839bbece OP_EQUAL"}}], "blockhash": "00000000007a07f1fe23d089eddd6731fffd2696fed36611c5e0529e5e9c13b9", "valueIn": 0.13541492, "fees": 6.892e-05, "vin": [{"addr": "n1QPb8R2VWL6s2t5HbtDdNX3A7h4QTeCxB", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_b0946dc27ba308a749b11afecc2018980af18f79e89ad6b080b58220d856f739.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1726
                                        Entropy (8bit):5.256948371351805
                                        Encrypted:false
                                        SSDEEP:48:YSP3d0yQq83yGamVd0yQqV3yGASpGXBVWRT2h2KjZR0mnnyIfCC7:fPdR8emRVcSpGXBkR428ZR08yIh
                                        MD5:9B166C7909788282BF8D91BDF7FD996C
                                        SHA1:198048794F637317EC778086E7809919C113C8AF
                                        SHA-256:1B7A3CDA05CFA1B80D7078580E62F90C2378496C5CBC892302BE7FF88F7D946D
                                        SHA-512:AA4A786D41EC7CB4A93BDBCD932A1FFA4665EB560BD4346060949D80A383D5E9032D3FAD6C782032BAAD7D0FF97558900FC3DEA4952E18D4C6EA4EE14910684A
                                        Malicious:false
                                        Preview:{"txid": "b0946dc27ba308a749b11afecc2018980af18f79e89ad6b080b58220d856f739", "version": 1, "locktime": 0, "vin": [{"txid": "d80c34ee14143a8bf61125102b7ef594118a3796cad670fa8ee15080ae155318", "vout": 1, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "473044022004b4045313f2b9f20c3d0d7e042c1caf3ee7af0531a4a4359c1f950f9b7780e602205abf837a2fdefd3ee708f052e740e763702bb40e976cab4e243035d4d77cb3b401210228fa17826fb9632c6e36ee31b32aebf20a81ee921b3d1c627a94b4b3dba879dd", "asm": "3044022004b4045313f2b9f20c3d0d7e042c1caf3ee7af0531a4a4359c1f950f9b7780e602205abf837a2fdefd3ee708f052e740e763702bb40e976cab4e243035d4d77cb3b4[ALL] 0228fa17826fb9632c6e36ee31b32aebf20a81ee921b3d1c627a94b4b3dba879dd"}, "addr": "mhu28zovdephvsYqdWicfYnCccTHwC3yfd", "valueSat": 193067531, "value": 1.93067531, "doubleSpentTxID": null}], "vout": [{"value": "0.55500000", "n": 0, "scriptPubKey": {"hex": "a9142880f749ea56a74031c2b222cf88937da6f58a3787", "asm": "OP_HASH160 2880f749ea56a74031c2b222cf88937da6f58a37 OP_EQUAL", "a

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_c9348040bbc2024e12dcb4a0b4806b0398646b91acf314da028c3f03dd0179fc.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):933
                                        Entropy (8bit):4.964094078069092
                                        Encrypted:false
                                        SSDEEP:24:YlT7LT4xVQY9FV4zN43XaRTfF+F8TrKNUnTu0+lwfmk:YlIVQY9FKG3AE8XKWnTilwp
                                        MD5:74AB61655D4803ACAD9335E38AC6E997
                                        SHA1:2DF647ABDDBBE59A686E6B342776DFAAD0C4A612
                                        SHA-256:264143AD4758F5532C828447A0AB9921897072FCB22A95D0DF4A80266A37EB1F
                                        SHA-512:C2D352D4A6E183D680EB54E71F2CADAE5D581BE4969746D7C5D6B96820DA3B02289E284F81C36121CB2C8ABCA0E15D304C868F758306EF5ACF59E41289FFF656
                                        Malicious:false
                                        Preview:{"valueOut": 0.01604, "vout": [{"spentIndex": 0, "spentHeight": 1112862, "value": "0.01604000", "n": 0, "spentTxId": "31bc1c88ce6ae337a6b3057a16d5bad0b561ad1dfc047d0a7fbb8814668f91e5", "scriptPubKey": {"hex": "00201e8dda334f11171190b3da72e526d441491464769679a319a2f011da5ad312a1", "asm": "0 1e8dda334f11171190b3da72e526d441491464769679a319a2f011da5ad312a1"}}], "blockhash": "0000000000000056aebed3be65011aa622d7aecb8d1265f21f58734acce5915f", "valueIn": 0.01605, "fees": 1e-05, "vin": [{"addr": null, "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.01605, "n": 0, "valueSat": 1605000, "txid": "f41cbedd8becee05a830f418d13aa665125464547db5c7a6cd28f21639fe1228", "scriptSig": {"hex": "", "asm": null}}], "txid": "c9348040bbc2024e12dcb4a0b4806b0398646b91acf314da028c3f03dd0179fc", "blocktime": 1467937587, "version": 1, "confirmations": 224391, "time": 1467937587, "blockheight": 897207, "locktime": 0, "size": 94}

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_d2dcdaf547ea7f57a713c607f15e883ddc4a98167ee2c43ed953c53cb5153e24.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1466
                                        Entropy (8bit):5.306569126167327
                                        Encrypted:false
                                        SSDEEP:24:Y7MZAPgE6uOX99/+YQByi89jiPUlP/dCgLKqOXG6c5hVty+2ZX19qIZ70eW00GzC:YUAubrZhpiP8PFCgWxW1J2dRx0TEJBG
                                        MD5:50257146388C4E586B2F15DBA10D47C8
                                        SHA1:EB22F05A3CECFDEB6F3B141C74D19009BD567A05
                                        SHA-256:012FD6590E8DDA29803E5655C3C52A94DBF18960B3B82AF916A67CBC773A1B14
                                        SHA-512:08932B2475372DBBE18947E8E09F6A2819C004E548342A05DBBF18D626469611E943963540D7E9B86A87B2AAC26C0AE2676D44C07C7023069F9135B354A12B37
                                        Malicious:false
                                        Preview:{"txid": "d2dcdaf547ea7f57a713c607f15e883ddc4a98167ee2c43ed953c53cb5153e24", "version": 1, "locktime": 0, "vin": [{"txid": "4e686d9815219fc2e57baae29c3b44567693b96fbe150550c269786fbbc6d653", "vout": 0, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "160014e31581ae69eca39192917940e6604fe6546441c0", "asm": "0014e31581ae69eca39192917940e6604fe6546441c0"}, "addr": "2N2Bw4ofaXx79bEdmG556FMGqa2EWmzJKr8", "valueSat": 2870562139, "value": 28.70562139, "doubleSpentTxID": null}], "vout": [{"value": "27.47158341", "n": 0, "scriptPubKey": {"hex": "a914f96f26251d4edd4c915aa76885dc0a91ec83df1087", "asm": "OP_HASH160 f96f26251d4edd4c915aa76885dc0a91ec83df10 OP_EQUAL", "addresses": ["2NFz7PpPg58HExT4stQDFoqpqduKaiwApqu"], "type": "scripthash"}, "spentTxId": "fe26bc077de27b72ffc5ce77a7e296c7c855b7deb3dec72a3f82c0c07c722bb0", "spentIndex": 0, "spentHeight": 1155197}, {"value": "1.23400000", "n": 1, "scriptPubKey": {"hex": "76a9145740ddea127387c6650ab531994fe6a29b0cec3388ac", "asm": "OP_DUP OP_HASH

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_d6da21677d7cca5f42fbc7631d062c9ae918a0254f7c6c22de8e8cb7fd5b8236.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):871
                                        Entropy (8bit):5.2418816855651995
                                        Encrypted:false
                                        SSDEEP:24:YYpsh5BYN+D45fx2ZBI3ovXWpSF1vFxvme+o9qzwJ4:Yp1Fkx2movpvMqIl
                                        MD5:721AC0A339013DD99590DD0E83B7B17C
                                        SHA1:347342B489BD47384B45580FEA5EBF31934D6431
                                        SHA-256:37644FAA0380D03A2FC1B52C3ECF601FF40383AB394C9670A9C747B6FB86F1CB
                                        SHA-512:38686F5639FC01118EE0C039CB447913308E38B7EECBCD2860D792C135FCAEB9B286EC9E97E6EBB0908A79E5243EE60932FD16D5BD21236781A801B65A09FBF4
                                        Malicious:false
                                        Preview:{"valueOut": 25.0027823, "isCoinBase": true, "vout": [{"spentIndex": 0, "spentHeight": 245746, "value": "25.00278230", "n": 0, "spentTxId": "871884776fe6aa078a16b66d82157ab4159257aa2889da9229f4e024ba40d6ee", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9140223b1a09138753c9cb0baf95a0a62c82711567a88ac", "addresses": ["mfiGQVPcRcaEvQPYDErR34DcCovtxYvUUV"], "asm": "OP_DUP OP_HASH160 0223b1a09138753c9cb0baf95a0a62c82711567a OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "000000000001994ec2997c267bc843d5b24032db26e5e1c56bffaf43c786a339", "vin": [{"coinbase": "0352bf03062f503253482f04f919855308f8000001c7000000092f7374726174756d2f", "n": 0, "sequence": 0}], "txid": "d6da21677d7cca5f42fbc7631d062c9ae918a0254f7c6c22de8e8cb7fd5b8236", "blocktime": 1401231865, "version": 1, "confirmations": 786738, "time": 1401231865, "blockheight": 245586, "locktime": 0, "size": 120}

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_d80c34ee14143a8bf61125102b7ef594118a3796cad670fa8ee15080ae155318.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1792
                                        Entropy (8bit):5.222998041543106
                                        Encrypted:false
                                        SSDEEP:24:Y7MNAr1gE/G06RXlAxUQltAxUQzYFFl2kBsVqIAA5i2Z2j9qINWWJ2I+KgcmHncd:YVNB6veqYdaVRAJ24BDEUxbd
                                        MD5:2B9A19BC9A948F04ED95BF338D151BF0
                                        SHA1:C7C5C3D72D8C55E9EABFE4E309E08A48686C26EA
                                        SHA-256:68B0B150BA33ED7790D56257C135ED60D59F480AF7F587D9D53E9A23E257ABC0
                                        SHA-512:7C184E28F548BADBF32286308D50975EAE88EAA3748D0E43488E9852CC037B2196985F7AF6595838D2E93F9E6BB6FCD001800CDBF4AB42627928AE1E1C5CF4BA
                                        Malicious:false
                                        Preview:{"txid": "d80c34ee14143a8bf61125102b7ef594118a3796cad670fa8ee15080ae155318", "version": 1, "locktime": 0, "vin": [{"txid": "16c6c8471b8db7a628f2b2bb86bfeefae1766463ce8692438c7fd3fce3f43ce5", "vout": 0, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "483045022100ea03d520495cd50b22b9c209f428de32aca2116c06e0fd391cf0a516a0974fff02207424a0742166fb4da9676fbfd09c8b5e7f73bdca72cd1088eb6037863448003d012102fbc883b74248b0207b22d42f591ba562db991494428adaaeb7c819ed3ac0cea9", "asm": "3045022100ea03d520495cd50b22b9c209f428de32aca2116c06e0fd391cf0a516a0974fff02207424a0742166fb4da9676fbfd09c8b5e7f73bdca72cd1088eb6037863448003d[ALL] 02fbc883b74248b0207b22d42f591ba562db991494428adaaeb7c819ed3ac0cea9"}, "addr": "mgJ6qw6qhWex1ePkbnaeTcSad7jca3Dpss", "valueSat": 227568531, "value": 2.27568531, "doubleSpentTxID": null}], "vout": [{"value": "0.34500000", "n": 0, "scriptPubKey": {"hex": "a914daa29c05a2af12752e459dedaee1d78e459c379c87", "asm": "OP_HASH160 daa29c05a2af12752e459dedaee1d78e459c379c OP_EQUAL"

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_e5040e1bc1ae7667ffb9e5248e90b2fb93cd9150234151ce90e14ab2f5933bcd.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1816
                                        Entropy (8bit):5.314516416564221
                                        Encrypted:false
                                        SSDEEP:48:YcLd8oCTRB2Y6aC8i2jo8PYDJT6wJgYjKc4H:TzM2Ovi2jo8PYD/gYjFM
                                        MD5:37E46A14D25F98EEF32FE14B837C67E9
                                        SHA1:67123509BAD10C39EE51179C8FC678843E606383
                                        SHA-256:83C93F48F2D8032F20210B95CE85BAE6B8D8934A0EE4D4ABD1848D30EAB368EF
                                        SHA-512:E085412803C4BFB1816F5E9B38C62A3C66DE3A980B2BA298696EDA4321A31D36E327538B770A4DA0710AEBFCB4D143A5596A791CC683331A5A043ADA74CC7385
                                        Malicious:false
                                        Preview:{"txid": "e5040e1bc1ae7667ffb9e5248e90b2fb93cd9150234151ce90e14ab2f5933bcd", "confirmations": 886416, "vout": [{"spentIndex": null, "spentHeight": null, "n": 0, "value": "0.31000000", "spentTxId": null, "scriptPubKey": {"addresses": ["mvbu1Gdy8SUjTenqerxUaZyYjmveZvt33q"], "asm": "OP_DUP OP_HASH160 a579388225827d9f2fe9014add644487808c695d OP_EQUALVERIFY OP_CHECKSIG", "hex": "76a914a579388225827d9f2fe9014add644487808c695d88ac", "type": "pubkeyhash"}}, {"spentIndex": null, "spentHeight": null, "n": 1, "value": "1.42920000", "spentTxId": null, "scriptPubKey": {"addresses": ["n1hLpUJwuAqRvhYDE3LH6VUEFJAMtTHp8e"], "asm": "OP_DUP OP_HASH160 dd597a4de23945b20a56446ce3a1b6e39cbf351c OP_EQUALVERIFY OP_CHECKSIG", "hex": "76a914dd597a4de23945b20a56446ce3a1b6e39cbf351c88ac", "type": "pubkeyhash"}}], "version": 1, "locktime": 0, "blockhash": "00000000204a06722dd65156b2c941ca4991246ad177f588c48999e50a2b0506", "valueIn": 1.7393, "valueOut": 1.7392, "blocktime": 1424379055, "fees": 0.0001, "time": 1424

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\safetlib\tests\txcache\insight_testnet_tx_f41cbedd8becee05a830f418d13aa665125464547db5c7a6cd28f21639fe1228.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1112
                                        Entropy (8bit):4.999595731548949
                                        Encrypted:false
                                        SSDEEP:24:YlTtnT+DpelDBZUCTEQ8TEaH8T4z343q1P+lEp3n:Yl5nTIYvx4Q8Qws3qYle
                                        MD5:6C6D1AC0BDF17A8E8C9292D15EE6EEC0
                                        SHA1:41E873D4C554DC72A37873E3B34A68B8A87686CB
                                        SHA-256:9109BD8F346990FB344E59B2EC5DD52BDA118978C169C93FB8FCBB780C913F1B
                                        SHA-512:34C9D7C5BEB5772C1AE7B33948FD2EF2624BD063C535B65C1E90366453FC49FCB588EA3C1C0B06EC4F80CEBBB85C91601219C2E7D214E3CEA06C66010C5374B3
                                        Malicious:false
                                        Preview:{"valueOut": 0.01605, "vout": [{"spentIndex": 0, "spentHeight": 897207, "value": "0.01605000", "n": 0, "spentTxId": "c9348040bbc2024e12dcb4a0b4806b0398646b91acf314da028c3f03dd0179fc", "scriptPubKey": {"hex": "0020c5f4a0a4ea7c0392efe0a9670a73264cffa90b19107cd8a8e9750ff93c77fdfb", "asm": "0 c5f4a0a4ea7c0392efe0a9670a73264cffa90b19107cd8a8e9750ff93c77fdfb"}}], "blockhash": "00000000000001813ec2fb42915573989417ce2bee539cafedf58294b3d69f43", "valueIn": 0.01610436, "fees": 5.436e-05, "vin": [{"addr": "2N2MxyAfifVhb3AMagisxaj3uij8bfXqf4Y", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.01610436, "n": 0, "valueSat": 1610436, "txid": "9c31922be756c06d02167656465c8dc83bb553bf386a3f478ae65b5c021002be", "scriptSig": {"hex": "2200201e8dda334f11171190b3da72e526d441491464769679a319a2f011da5ad312a1", "asm": "00201e8dda334f11171190b3da72e526d441491464769679a319a2f011da5ad312a1"}}], "txid": "f41cbedd8becee05a830f418d13aa665125464547db5c7a6cd28f21639fe1228", "blocktime": 146793075

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\select.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):27416
                                        Entropy (8bit):6.835600420682668
                                        Encrypted:false
                                        SSDEEP:768:+WFXERsAnq2NWow4VILQGR5YiSyvLPxWEa0P+:+xqwWow4VILQGf7SyzPx+
                                        MD5:6EBA3E39E61C839818F502BD67BBD672
                                        SHA1:CD724D843CA57F6EDBBBE94B3C352769F70AED65
                                        SHA-256:C942F16C17687E988434813E50D2FB222C528D0E56CCF2D15B13104676F93FC9
                                        SHA-512:8614F4DBF7DF68D66BA611B31135EB35EF5C6D24E1C3F3EC4E8DF67BE75102DA991F26FEA76EF930B686A1ED08AD4A4C5F62CB2BEA4233B26D276FFD3C54FC31
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5$..qE{.qE{.qE{.x=..sE{.#0z.sE{.#0~.zE{.#0..{E{.#0x.sE{..0z.sE{.qEz.LE{.:=z.tE{..0s.pE{..0{.pE{..0..pE{..0y.pE{.RichqE{.........PE..L...H.,d...........!........."...............0......................................u%....@..........................:..L....;..x....`...............<.../...p......D6..T............................6..@............0...............................text............................... ..`.rdata.."....0......................@..@.data........P......................@....rsrc........`.......0..............@..@.reloc.......p.......:..............@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\sqlite3.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):1196824
                                        Entropy (8bit):6.776326140308749
                                        Encrypted:false
                                        SSDEEP:24576:E6OOR2q+dGpg4XzLojJT5r6hKarVTgnEEUNTZOdEV8RpDq+m5:zR2L94Xo5Q5OEeEYDzm5
                                        MD5:C60F6C4051EB55350C6EEDF5A87016AA
                                        SHA1:DB1C31C12BE04A5785D7CA3B8EA91B290EE9D1D8
                                        SHA-256:376D80DB08CEC2C8873A4D5EBC7D83F50F26A43EBAA837020874C8586FD85975
                                        SHA-512:FCBDFC27A778B1084BE96B88CF438E0937ADB8BABC41B538892B76283232AA557CE46701A8F62AB2FDB208AB0933F0E473CBD6DAD59203DC7495F48EE289B2A3
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.............^....L.....L.....L.....L.....U.........................2..........Rich...................PE..L.....,d...........!................_........................................@.......7....@.........................`;..."...].........................../...........5..T........................... 6..@............................................text............................... ..`.rdata...Y.......Z..................@..@.data....'...p..."...Z..............@....rsrc................|..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI76522\unicodedata.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):1114904
                                        Entropy (8bit):5.393522969186712
                                        Encrypted:false
                                        SSDEEP:12288:PAKqQCb5Pfhnzr0qlmL8klMmuZ63NGM7IRG5eeIDe6VZyrIBHdQLhfFE+tc9S:PAKsZV0mmduJMMREtIC6Vo4uLc9S
                                        MD5:73A25EF47977BFF82315023F7F8E9DB1
                                        SHA1:9BD7882C39A995EA4044FB5D562060C16AF9A023
                                        SHA-256:AC2966C1A1F1FBEE97666E0AAADE5AB960B445AF3BACC1650B83EA8B637F2F7A
                                        SHA-512:C6155957E37C7A690E815F78508CCDCE9036E2EFFE45A9B47EAAFBB8A091D661B808C1A2CC6C7B83B41752121B869A877C981EE346B790F3CF3900A3D6F0B198
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#..p..p..p...p..p..q..p..q...p..q..p..q..p..q..p..q..p..p...p..q..p..q..p..tp..p..q..pRich..p........................PE..L...K.,d...........!.....8...........=.......P.......................................X....@.............................X................................/..............T...........................P...@............P..,............................text...J7.......8.................. ..`.rdata...}...P...~...<..............@..@.data...8...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Roaming\Electrum\blockchain_headers

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):67576320
                                        Entropy (8bit):0.0
                                        Encrypted:false
                                        SSDEEP:3::
                                        MD5:687BAADADABCA3630EEDD8BB5106DFF0
                                        SHA1:1AA84844AE7692308555972934378C34091AD2B8
                                        SHA-256:6E93D6F509DCD1A99A4F51877CF8DA1D53ED3C7490B2B20D23F4C437A1B02F83
                                        SHA-512:433B645229EF7002FDE4763F99408C07705F671FF3D57102B1A04980F6F0CA0E7D7D48D29712963DCD9D7F3F281E9EEE30102C6DF583E069A5ACEA396DCED59D
                                        Malicious:true
                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Roaming\Electrum\config

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):252
                                        Entropy (8bit):4.965228909237798
                                        Encrypted:false
                                        SSDEEP:6:3FFBWLURhvFNGwApr9ApRZvFsheQV+AH6ZF2lqqA:1bW+vdmA0hhV+AH67qA
                                        MD5:D30749C308BF00D2DD36E57D2FC220AC
                                        SHA1:D67F397570D624437E0C3B5E520816B21FBF9457
                                        SHA-256:5F1F9F1580CDBA9423BF564CC4A7E47EE241AB4E41F91B0B73EFB7D2B28BA8CE
                                        SHA-512:8119769F8C5583D440C2D21C05694B53E4886336260CF6B584156A49677A2FFFD192F1F9CF30B055B5B8CCF84251A16CC4919DD89264232A60B8F6C4652073E7
                                        Malicious:true
                                        Preview:{.. "blockchain_preferred_block": {.. "hash": "000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f",.. "height": 0.. },.. "config_version": 3,.. "rpcpassword": "Q1z-lkqDNTEGcpP8d1Dcgg==",.. "rpcuser": "user"..}

                                        C:\Users\user\AppData\Roaming\Electrum\daemon

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:dropped
                                        Size (bytes):49
                                        Entropy (8bit):3.977182681716688
                                        Encrypted:false
                                        SSDEEP:3:RLVuMkj:nDkj
                                        MD5:85D06DAFE44B8430EC24F8AC558088E4
                                        SHA1:8BE097E8908033DF514C187D8F65470016A1ECAE
                                        SHA-256:EB85DF6901A13FF7D88F43FD6FCFFD5DE7F6AF4FD99BC0F1D27E804D2E01CCB1
                                        SHA-512:29ABD934AFC1B0320EFFB4D155D6A50B11B3C489EEDEAEAFBA514AA3DDAAA00B495140C12DD4BB8BEB5DF2D7EFAC45567135BE232FDB5D2EA7C204A213BFD93D
                                        Malicious:false
                                        Preview:('tcp', ('127.0.0.1', 49727), 1725565358.2171912)

                                        Static File Info

                                        General

                                        File type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                        Entropy (8bit):7.998115015420231
                                        TrID:
                                        • Win32 Executable (generic) a (10002005/4) 99.53%
                                        • InstallShield setup (43055/19) 0.43%
                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                        • DOS Executable Generic (2002/1) 0.02%
                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                        File name:SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File size:47'764'104 bytes
                                        MD5:d430fb367b17fdd8a5f7fd72c16e0477
                                        SHA1:bd832259a3dd2e8d0c4e421bdf92c0a7b06f9049
                                        SHA256:3710df97f996f8f6390fa8b23bbafea03f2e7568bf00297f737324f380f06675
                                        SHA512:255c2888007b0236c70c74293995e23a78f921a6712abaffefccd4d4a85c5ce1a3d1d7e40e60fc3fcfc194c979e9d4497860f4572b75b16d8d55304bfc18652f
                                        SSDEEP:786432:MF8WWxUd9d1LRphkc3FphiWGlso5EYWAFPMUcgDB2hREoBdImGIcmdK1RdiG+udQ:MF8WWxU9ddRzFphiZd5EXUcgD4hAIzsY
                                        TLSH:8CA733C68DB20073F422057BACD5FDF1873E12E8AB76842BDA39045765BBCE1195263B
                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n05[........../....#.j........................@..........................`.......C.....................................

                                        File Icon

                                        Icon Hash:2b2d33aaaa232d33

                                        Static PE Info

                                        General

                                        Entrypoint:0x4014b0
                                        Entrypoint Section:.text
                                        Digitally signed:true
                                        Imagebase:0x400000
                                        Subsystem:windows gui
                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED
                                        DLL Characteristics:
                                        Time Stamp:0x5B35306E [Thu Jun 28 19:01:02 2018 UTC]
                                        TLS Callbacks:0x40d830, 0x40d7e0
                                        CLR (.Net) Version:
                                        OS Version Major:4
                                        OS Version Minor:0
                                        File Version Major:4
                                        File Version Minor:0
                                        Subsystem Version Major:4
                                        Subsystem Version Minor:0
                                        Import Hash:e9d858bf5cc2b22933333fd98518c716

                                        Authenticode Signature

                                        Signature Valid:true
                                        Signature Issuer:CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1, O=EnVers Group SIA, C=LV
                                        Signature Validation Error:The operation completed successfully
                                        Error Number:0
                                        Not Before, Not After
                                        • 08/05/2024 02:00:00 08/05/2025 01:59:59
                                        Subject Chain
                                        • CN=Electrum Technologies GmbH, O=Electrum Technologies GmbH, L=Berlin, S=Berlin, C=DE
                                        Version:3
                                        Thumbprint MD5:147702A38DDFCC9690E07814BB328522
                                        Thumbprint SHA-1:BFF7076B4C517AEE0E3D2CCAA7F894C2399010CF
                                        Thumbprint SHA-256:2FC8F7385221D01B0010390F40A0653A72CF36EFE729B8FF21FBF8F1C458385F
                                        Serial:0207B0D2256E682FD464B51556AD55A7

                                        Entrypoint Preview

                                        Instruction
                                        mov dword ptr [004302A8h], 00000001h
                                        jmp 00007F39C8E90196h
                                        nop
                                        mov dword ptr [004302A8h], 00000000h
                                        jmp 00007F39C8E90186h
                                        nop
                                        sub esp, 1Ch
                                        mov eax, dword ptr [esp+20h]
                                        mov dword ptr [esp], eax
                                        call 00007F39C8EA5D86h
                                        test eax, eax
                                        sete al
                                        add esp, 1Ch
                                        movzx eax, al
                                        neg eax
                                        ret
                                        nop
                                        nop
                                        nop
                                        push ebp
                                        mov ebp, esp
                                        push edi
                                        push esi
                                        push ebx
                                        sub esp, 1Ch
                                        mov dword ptr [esp], 00419000h
                                        call dword ptr [00431370h]
                                        sub esp, 04h
                                        test eax, eax
                                        je 00007F39C8E90555h
                                        mov ebx, eax
                                        mov dword ptr [esp], 00419000h
                                        call dword ptr [00431390h]
                                        mov edi, dword ptr [00431378h]
                                        sub esp, 04h
                                        mov dword ptr [00422028h], eax
                                        mov dword ptr [esp+04h], 00419013h
                                        mov dword ptr [esp], ebx
                                        call edi
                                        sub esp, 08h
                                        mov esi, eax
                                        mov dword ptr [esp+04h], 00419029h
                                        mov dword ptr [esp], ebx
                                        call edi
                                        mov dword ptr [00418004h], eax
                                        sub esp, 08h
                                        test esi, esi
                                        je 00007F39C8E904F3h
                                        mov dword ptr [esp+04h], 0042202Ch
                                        mov dword ptr [esp], 0041F000h
                                        call esi
                                        mov dword ptr [esp], 004015A0h
                                        call 00007F39C8E90443h
                                        lea esp, dword ptr [ebp-0Ch]
                                        pop ebx
                                        pop esi

                                        Data Directories

                                        NameVirtual AddressVirtual Size Is in Section
                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x310000x10dc.idata
                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x350000x10148.rsrc
                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x2d8aa680x2820
                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_TLS0x1d9e40x18.rdata
                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IAT0x313040x278.idata
                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                        Sections

                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                        .text0x10000x168440x16a00bfa94cc0c6fba6cfbec218f12bae7497False0.49559737569060774data6.147093437333147IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                        .data0x180000x7c0x2005f248157483c9031b1f144a8f35a67cdFalse0.158203125data1.0951453424827384IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .rdata0x190000x5ab80x5c00aacd1e7ef1965ac5f96b9f65821eebe5False0.4833984375data6.42318523882154IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
                                        /40x1f0000x282c0x2a005ade56e21c5cc0870eed26c14dc73992False0.31156994047619047data4.885403344130252IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
                                        .bss0x220000xecb40x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .idata0x310000x10dc0x12001a0f376f0f1923d8b6ac09985cd92d62False0.3878038194444444PGP symmetric key encrypted data - Plaintext or unencrypted data5.130264530707902IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .CRT0x330000x340x2003d6d77b813b142a365114d8d26628b28False0.0703125Matlab v4 mat-file (little endian) \220\327@, numeric, rows 4198704, columns 00.2709192282599745IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .tls0x340000x80x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .rsrc0x350000x110000x102003b12c52c6e1917222adab677428556b6False0.6228197674418605data6.0401874871081915IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                        Resources

                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                        RT_ICON0x352080x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.38853790613718414
                                        RT_ICON0x35ab00x6d06PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9946255822285919
                                        RT_ICON0x3c7b80x4228Device independent bitmap graphic, 64 x 128 x 32, image size 00.2696622579121398
                                        RT_ICON0x409e00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.34315352697095436
                                        RT_ICON0x42f880x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.38672607879924953
                                        RT_ICON0x440300x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 00.5866279069767442
                                        RT_ICON0x446e80x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.5328014184397163
                                        RT_GROUP_ICON0x44b500x68data0.7596153846153846
                                        RT_MANIFEST0x44bb80x590XML 1.0 document, ASCII text, with CRLF line terminators0.44662921348314605

                                        Imports

                                        DLLImport
                                        ADVAPI32.dllConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetTokenInformation, OpenProcessToken
                                        COMCTL32.DLLLoadIconMetric
                                        GDI32.dllCreateFontIndirectW, DeleteObject, SelectObject
                                        KERNEL32.dllCloseHandle, CreateDirectoryW, CreateProcessW, DeleteCriticalSection, EnterCriticalSection, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FormatMessageW, FreeLibrary, GetCommandLineW, GetCurrentProcess, GetEnvironmentVariableW, GetExitCodeProcess, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetStartupInfoW, GetTempPathW, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LocalFree, MulDiv, MultiByteToWideChar, SetConsoleCtrlHandler, SetDllDirectoryW, SetEnvironmentVariableW, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte
                                        msvcrt.dll__argc, __lconv_init, __mb_cur_max, __p__commode, __p__fmode, __p__wcmdln, __set_app_type, __setusermatherr, __wargv, __wgetmainargs, __winitenv, _amsg_exit, _cexit, _errno, _filelengthi64, _fileno, _findclose, _get_osfhandle, _initterm, _iob, _lock, _onexit, _setmode, _snwprintf, fwprintf, _unlock, _wcsdup, _wfopen, _wfullpath, _wputenv_s, _wremove, _wrmdir, _wtempnam, abort, atoi, calloc, clearerr, exit, fclose, feof, ferror, fflush, fgetpos, fprintf, fputc, fputwc, fread, free, fsetpos, fwrite, iswctype, localeconv, malloc, mbstowcs, memcmp, memcpy, memset, perror, realloc, setbuf, setlocale, signal, strcat, strchr, strcmp, strcpy, strerror, strlen, strncat, strncmp, strncpy, strtok, vfprintf, wcscat, wcschr, wcscmp, wcscpy, wcslen, wcsncpy, wcstombs, _wstat, _wfindnext, _wfindfirst, _stat, _wcsdup, _strdup, _getpid, _fileno
                                        USER32.dllCreateWindowExW, DestroyIcon, DialogBoxIndirectParamW, DrawTextW, EndDialog, GetClientRect, GetDC, GetDialogBaseUnits, GetWindowLongW, InvalidateRect, MessageBoxA, MessageBoxW, MoveWindow, ReleaseDC, SendMessageW, SetWindowLongW, SystemParametersInfoW

                                        Network Behavior

                                        Network Port Distribution

                                        UDP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Sep 5, 2024 20:28:49.045609951 CEST5362282162.159.36.2192.168.2.7
                                        Sep 5, 2024 20:28:49.510045052 CEST5934053192.168.2.71.1.1.1
                                        Sep 5, 2024 20:28:49.517741919 CEST53593401.1.1.1192.168.2.7

                                        DNS Queries

                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                        Sep 5, 2024 20:28:49.510045052 CEST192.168.2.71.1.1.10x3cc9Standard query (0)15.164.165.52.in-addr.arpaPTR (Pointer record)IN (0x0001)false

                                        DNS Answers

                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                        Sep 5, 2024 20:28:49.517741919 CEST1.1.1.1192.168.2.70x3cc9Name error (3)15.164.165.52.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false

                                        Statistics

                                        CPU Usage

                                        Click to jump to process

                                        Memory Usage

                                        Click to jump to process

                                        High Level Behavior Distribution

                                        Click to dive into process behavior distribution

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        General

                                        Target ID:1
                                        Start time:14:28:16
                                        Start date:05/09/2024
                                        Path:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"
                                        Imagebase:0x400000
                                        File size:47'764'104 bytes
                                        MD5 hash:D430FB367B17FDD8A5F7FD72C16E0477
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:low
                                        Has exited:false

                                        General

                                        Target ID:6
                                        Start time:15:42:27
                                        Start date:05/09/2024
                                        Path:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"
                                        Imagebase:0x400000
                                        File size:47'764'104 bytes
                                        MD5 hash:D430FB367B17FDD8A5F7FD72C16E0477
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:low
                                        Has exited:false

                                        General

                                        Target ID:8
                                        Start time:15:42:31
                                        Start date:05/09/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                        Imagebase:0x730000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:9
                                        Start time:15:42:31
                                        Start date:05/09/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff75da10000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:10
                                        Start time:15:42:32
                                        Start date:05/09/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                        Imagebase:0x410000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:11
                                        Start time:15:42:33
                                        Start date:05/09/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff75da10000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:12
                                        Start time:15:42:36
                                        Start date:05/09/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1
                                        Imagebase:0x410000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:13
                                        Start time:15:42:36
                                        Start date:05/09/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff75da10000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:14
                                        Start time:15:42:37
                                        Start date:05/09/2024
                                        Path:C:\Windows\SysWOW64\fsutil.exe
                                        Wow64 process (32bit):true
                                        Commandline:fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1
                                        Imagebase:0xcd0000
                                        File size:167'440 bytes
                                        MD5 hash:452CA7574A1B2550CD9FF83DDBE87463
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:moderate
                                        Has exited:true

                                        Disassembly

                                        Reset < >

                                          Execution Graph

                                          Execution Coverage:1.6%
                                          Dynamic/Decrypted Code Coverage:0%
                                          Signature Coverage:9.5%
                                          Total number of Nodes:1391
                                          Total number of Limit Nodes:32
                                          execution_graph 19701 407940 19702 40794e 19701->19702 19703 4079a7 GetTempPathW _getpid 19702->19703 19704 40795b 19702->19704 19737 4074c0 19703->19737 19754 407650 19704->19754 19707 4079e9 _wtempnam 19740 408d40 19707->19740 19708 407967 19763 4077c0 19708->19763 19712 40797a 19715 407984 _wputenv_s free 19712->19715 19716 407a8a 19712->19716 19713 407ab0 19808 408920 19713->19808 19714 407a08 free 19714->19707 19719 407a15 19714->19719 19715->19703 19717 407aa0 19715->19717 19803 402ed0 19717->19803 19719->19716 19725 407a50 19719->19725 19726 407a28 19719->19726 19723 407a42 19724 407ae7 19727 407b0c 19724->19727 19728 407aef 19724->19728 19790 408b00 19725->19790 19785 407700 19726->19785 19733 408b00 12 API calls 19727->19733 19731 407700 15 API calls 19728->19731 19735 407aff free 19731->19735 19732 407a3a free 19732->19723 19736 407b28 SetEnvironmentVariableW free 19733->19736 19735->19723 19736->19723 19820 40f180 19737->19820 19739 4074e7 19739->19707 19855 40e630 19740->19855 19743 408e60 GetTokenInformation 19746 408ea1 calloc 19743->19746 19747 408e92 GetLastError 19743->19747 19744 408d96 19745 408d9c free 19744->19745 19748 408db9 _snwprintf LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 19745->19748 19749 408dad FindCloseChangeNotification 19745->19749 19746->19744 19750 408ec3 GetTokenInformation 19746->19750 19747->19744 19747->19746 19751 407a00 19748->19751 19752 408e2c CreateDirectoryW 19748->19752 19749->19748 19750->19745 19753 408eeb ConvertSidToStringSidW 19750->19753 19751->19713 19751->19714 19752->19751 19753->19745 19755 40765b 19754->19755 19756 408b00 12 API calls 19755->19756 19757 407680 GetEnvironmentVariableW 19756->19757 19758 4076b0 ExpandEnvironmentStringsW 19757->19758 19759 40769c 19757->19759 19760 408920 15 API calls 19758->19760 19759->19708 19761 4076e7 19760->19761 19761->19759 19762 4076f0 _strdup 19761->19762 19762->19708 19764 4077ce 19763->19764 19765 408b00 12 API calls 19764->19765 19766 4077ef 19765->19766 19767 40790e 19766->19767 19768 4077f9 ExpandEnvironmentStringsW free 19766->19768 19767->19712 19771 402ed0 12 API calls 19767->19771 19769 407900 19768->19769 19770 407827 19768->19770 19772 402ed0 12 API calls 19769->19772 19857 408fa0 wcslen 19770->19857 19775 4078e2 19771->19775 19772->19767 19775->19712 19776 4078f0 _wcsdup 19778 407852 19776->19778 19777 407837 _wfullpath 19777->19778 19779 40785a wcschr 19778->19779 19780 40792e 19778->19780 19782 4078d2 CreateDirectoryW 19779->19782 19783 407888 19779->19783 19781 402ed0 12 API calls 19780->19781 19781->19775 19782->19775 19784 407890 wcsncpy CreateDirectoryW wcschr 19783->19784 19784->19782 19784->19784 19786 408b00 12 API calls 19785->19786 19787 407722 19786->19787 19788 408b00 12 API calls 19787->19788 19789 407740 _wputenv_s free free 19788->19789 19789->19732 19791 408b60 MultiByteToWideChar 19790->19791 19792 408b13 19790->19792 19793 408bf8 19791->19793 19794 408b9c calloc 19791->19794 19795 408b1d MultiByteToWideChar 19792->19795 19796 402f90 9 API calls 19793->19796 19794->19795 19797 408bb9 19794->19797 19798 408bd8 19795->19798 19799 407a6c SetEnvironmentVariableW free 19795->19799 19796->19799 19860 402f90 GetLastError 19797->19860 19800 402f90 9 API calls 19798->19800 19799->19716 19800->19799 19804 40f100 3 API calls 19803->19804 19805 402f01 19804->19805 19806 402df0 12 API calls 19805->19806 19807 402f19 19806->19807 19807->19723 19809 408990 WideCharToMultiByte 19808->19809 19810 408933 19808->19810 19812 408a38 19809->19812 19813 4089dc calloc 19809->19813 19811 40893d WideCharToMultiByte 19810->19811 19814 408a18 19811->19814 19819 407ad0 free 19811->19819 19816 402f90 12 API calls 19812->19816 19813->19811 19815 4089f9 19813->19815 19818 402f90 12 API calls 19814->19818 19817 402f90 12 API calls 19815->19817 19816->19819 19817->19819 19818->19819 19819->19723 19819->19724 19821 40f1d0 19820->19821 19822 40f199 19820->19822 19824 4137e0 7 API calls 19821->19824 19827 4137e0 _errno 19822->19827 19826 40f1f0 19824->19826 19826->19739 19829 413868 19827->19829 19836 40f1b8 19827->19836 19828 4138d0 19832 411e60 6 API calls 19828->19832 19834 4138f6 19828->19834 19829->19828 19830 413899 19829->19830 19830->19836 19837 411e60 19830->19837 19832->19834 19833 411e60 6 API calls 19835 4140f3 19833->19835 19834->19833 19834->19836 19835->19835 19836->19739 19838 411e74 19837->19838 19839 411f90 19838->19839 19840 411e93 19838->19840 19841 411fe3 fwprintf 19839->19841 19842 411f96 19839->19842 19848 411e97 19840->19848 19851 4119e0 19840->19851 19843 411ea2 19841->19843 19844 411fa7 fwprintf 19842->19844 19845 411ffd fwprintf 19842->19845 19843->19836 19844->19843 19845->19843 19847 411f40 19847->19843 19849 411f76 fputwc 19847->19849 19848->19843 19848->19847 19850 411eed fputwc 19848->19850 19849->19847 19850->19848 19852 4119f1 19851->19852 19853 411a00 19852->19853 19854 411a18 fputwc 19852->19854 19853->19840 19854->19840 19856 408d4e GetCurrentProcess OpenProcessToken 19855->19856 19856->19743 19856->19744 19858 408fc8 iswctype 19857->19858 19859 40782f 19857->19859 19858->19859 19859->19776 19859->19777 19869 40f100 19860->19869 19862 402fcd 19876 4086f0 19862->19876 19864 402fd9 19888 402dc0 19864->19888 19868 40301c 19868->19799 19870 40f150 19869->19870 19871 40f119 19869->19871 19873 411040 3 API calls 19870->19873 19899 411040 _errno 19871->19899 19875 40f170 19873->19875 19875->19862 19877 4086fb 19876->19877 19878 4087d0 GetLastError 19877->19878 19879 40870c FormatMessageW 19877->19879 19878->19879 19880 4087a8 19879->19880 19881 40874c WideCharToMultiByte 19879->19881 19884 402f90 9 API calls 19880->19884 19882 4087e0 19881->19882 19883 40879b 19881->19883 19886 402f90 9 API calls 19882->19886 19883->19864 19885 4087bc 19884->19885 19885->19864 19887 4087f4 19886->19887 19887->19864 19889 40f100 3 API calls 19888->19889 19890 402de7 19889->19890 19891 402df0 19890->19891 19892 402dfc 19891->19892 19893 408b00 10 API calls 19892->19893 19894 402e38 19893->19894 19895 402e90 MessageBoxA 19894->19895 19896 402e3c 19894->19896 19895->19868 19897 408b00 10 API calls 19896->19897 19898 402e5e MessageBoxW 19897->19898 19898->19868 19901 4110e2 19899->19901 19903 40f138 19899->19903 19900 4111a0 fputc 19900->19901 19901->19900 19901->19903 19904 40f340 19901->19904 19903->19862 19905 40f350 19904->19905 19906 40f378 fputc 19905->19906 19907 40f35f 19905->19907 19906->19901 19907->19901 19908 404300 19909 40430b 19908->19909 19916 4042d0 19909->19916 19912 40436b 19915 4042d0 3 API calls 19915->19912 19917 40f100 3 API calls 19916->19917 19918 4042f7 19917->19918 19918->19912 19919 40e900 setlocale 19918->19919 19920 40e923 _strdup 19919->19920 19921 40e92d setlocale 19919->19921 19920->19921 19922 40e950 wcstombs realloc wcstombs setlocale free 19921->19922 19923 40e948 19921->19923 19925 404348 19922->19925 19923->19922 19924 40e9c8 mbstowcs 19923->19924 19926 40e630 19924->19926 19925->19915 19927 40e9f7 mbstowcs 19926->19927 19928 40ea42 19927->19928 19929 40ea21 19927->19929 19930 40ea6e 19928->19930 19932 40ea80 19928->19932 19929->19928 19931 40ec55 setlocale free 19929->19931 19930->19922 19931->19925 19933 40eae1 wcstombs realloc wcstombs 19932->19933 19938 40eb70 19932->19938 19935 40eb4e setlocale free 19933->19935 19935->19925 19936 40ec9b wcstombs 19936->19935 19937 40ecc2 19936->19937 19937->19935 19938->19936 19938->19938 19939 401e60 19940 402020 19939->19940 19941 401e75 19939->19941 19982 4046b0 19940->19982 19953 402014 19941->19953 19968 408550 malloc 19941->19968 19944 401eaa 19944->19953 19979 40ef60 19944->19979 19947 401ed4 fread 19950 402061 19947->19950 19951 401efd 19947->19951 19948 40208f 19949 403030 14 API calls 19948->19949 19949->19953 19952 403030 14 API calls 19950->19952 19954 40ef60 6 API calls 19951->19954 19952->19953 19955 401f57 malloc 19954->19955 19956 4020a5 19955->19956 19957 401f6d fread 19955->19957 19958 403030 14 API calls 19956->19958 19959 402046 19957->19959 19960 401f8f ferror 19957->19960 19958->19953 19988 403030 19959->19988 19961 40207c 19960->19961 19964 401fac 19960->19964 19963 402ed0 12 API calls 19961->19963 19963->19953 19966 402ed0 12 API calls 19964->19966 19967 401ff6 19964->19967 19965 402006 fclose 19965->19953 19966->19964 19967->19953 19967->19965 19969 408571 19968->19969 19970 4086b2 free 19968->19970 19971 40ef60 6 API calls 19969->19971 19970->19944 19973 40858d 19971->19973 19973->19970 19995 40f050 19973->19995 19975 40ef60 6 API calls 19977 4085a1 19975->19977 19976 40863f fread 19976->19970 19976->19977 19977->19970 19977->19975 19977->19976 19978 408670 memcmp 19977->19978 19978->19970 19978->19977 20000 40ef90 19979->20000 19983 4046bc 19982->19983 19984 408b00 12 API calls 19983->19984 19985 4046e1 19984->19985 19986 408b00 12 API calls 19985->19986 19987 4046fc _wfopen 19986->19987 19987->19941 19989 40f100 3 API calls 19988->19989 19990 403064 _errno strerror 19989->19990 19991 402dc0 3 API calls 19990->19991 19992 4030a3 19991->19992 19993 402df0 12 API calls 19992->19993 19994 4030bb 19993->19994 19994->19953 19998 40f070 fgetpos 19995->19998 19999 40f05f 19998->19999 19999->19977 20001 40efd8 fgetpos 20000->20001 20002 40efac 20000->20002 20003 40efec 20001->20003 20007 401ecc 20001->20007 20004 40f000 fflush _fileno _filelengthi64 20002->20004 20005 40efb1 20002->20005 20003->20004 20006 40efc1 fsetpos 20003->20006 20004->20006 20008 40efb5 20005->20008 20009 40f02a _errno 20005->20009 20006->20007 20007->19947 20007->19948 20008->20006 20009->20007 20010 401124 __wgetmainargs 20011 401de6 20012 401df0 20011->20012 20013 403030 14 API calls 20012->20013 20014 401d46 20013->20014 20015 401d5c fclose 20014->20015 20016 401d4d fclose 20014->20016 20017 401d68 20015->20017 20016->20015 20018 408668 20019 408670 memcmp 20018->20019 20021 4086b2 free 20019->20021 20022 4085d6 20019->20022 20022->20019 20022->20021 20023 40ef60 6 API calls 20022->20023 20024 40863f fread 20022->20024 20023->20022 20024->20021 20024->20022 20025 407dd0 20026 407dde 20025->20026 20055 4074f0 20026->20055 20029 407f05 20030 4074f0 3 API calls 20031 407e3c 20030->20031 20031->20029 20032 407e47 strlen strtok 20031->20032 20033 407f18 20032->20033 20034 407e6b 20032->20034 20035 408b00 12 API calls 20033->20035 20036 407e78 strlen 20034->20036 20053 408d40 13 API calls 20034->20053 20037 407f33 _wstat 20035->20037 20036->20029 20038 407e8c strlen strcpy strtok 20036->20038 20039 407f67 20037->20039 20040 407f48 20037->20040 20038->20033 20041 407ec2 20038->20041 20043 4046b0 13 API calls 20039->20043 20042 407f53 20040->20042 20049 407650 18 API calls 20040->20049 20044 408b00 12 API calls 20041->20044 20045 407ef5 20042->20045 20046 407f57 20042->20046 20047 407f77 20043->20047 20048 407ed6 _wstat 20044->20048 20058 402f30 20045->20058 20051 402f30 12 API calls 20046->20051 20048->20034 20048->20036 20052 407f8e 20049->20052 20051->20039 20052->20046 20054 407f9e free 20052->20054 20053->20034 20054->20042 20056 40f100 3 API calls 20055->20056 20057 407517 20056->20057 20057->20029 20057->20030 20059 40f100 3 API calls 20058->20059 20060 402f61 20059->20060 20061 402df0 12 API calls 20060->20061 20062 402f79 20061->20062 20062->20029 20063 40a090 20064 40a150 malloc 20063->20064 20065 40a0a9 20063->20065 20064->20065 20066 40a0f0 20064->20066 20067 40a100 memcpy 20065->20067 20068 40a0cf memcpy 20065->20068 20066->20067 20070 40a140 20066->20070 20067->20066 20069 40a190 memcpy 20067->20069 20068->20066 20071 408190 20072 40819e 20071->20072 20073 408b00 12 API calls 20072->20073 20074 4081cc SetConsoleCtrlHandler GetStartupInfoW 20073->20074 20075 40824b _fileno _get_osfhandle 20074->20075 20076 408274 _fileno _get_osfhandle 20075->20076 20077 408297 _fileno _get_osfhandle GetCommandLineW CreateProcessW 20076->20077 20078 408350 20077->20078 20079 40830e WaitForSingleObject GetExitCodeProcess 20077->20079 20080 402f90 12 API calls 20078->20080 20081 408364 20080->20081 20082 40a4b1 20083 40a436 malloc 20082->20083 20085 40a45c 20083->20085 20086 4011b3 20087 4011b8 20086->20087 20088 4011c0 Sleep 20087->20088 20093 4011ea 20087->20093 20090 4011cc 20088->20090 20089 401406 _amsg_exit 20091 401420 _initterm 20089->20091 20089->20093 20090->20087 20098 4011da 20090->20098 20091->20093 20092 401478 _initterm 20094 40149b 20092->20094 20093->20089 20093->20091 20093->20092 20093->20098 20096 4014a3 exit 20094->20096 20097 401241 SetUnhandledExceptionFilter 20097->20098 20098->20089 20098->20093 20099 401267 __p__wcmdln 20098->20099 20100 4012eb malloc 20098->20100 20101 4012e6 20098->20101 20112 40db40 20098->20112 20099->20098 20100->20094 20102 401311 20100->20102 20101->20100 20102->20102 20103 401346 malloc memcpy 20102->20103 20103->20102 20104 40136f 20103->20104 20124 40d770 20104->20124 20106 401388 20129 40d7a0 20106->20129 20109 4013c2 20110 4013d0 20109->20110 20111 401462 _cexit 20109->20111 20117 40db60 20112->20117 20123 40db53 20112->20123 20113 40dd9f 20115 40d980 11 API calls 20113->20115 20114 40dd00 20119 40dccd 20114->20119 20114->20123 20158 40d9e0 20114->20158 20118 40ddb9 20115->20118 20117->20113 20117->20114 20117->20119 20120 40d9e0 11 API calls 20117->20120 20117->20123 20132 40d980 20117->20132 20118->20097 20122 40dd72 VirtualProtect 20119->20122 20119->20123 20120->20117 20122->20119 20123->20097 20125 40d779 20124->20125 20128 40d710 20124->20128 20125->20106 20127 40d740 20127->20106 20182 4014d0 _onexit 20128->20182 20183 4015d0 20129->20183 20180 4173a0 20132->20180 20134 40d994 fwrite 20181 4173a0 20134->20181 20136 40d9c0 vfprintf abort 20142 40d9e0 20136->20142 20137 40da90 20137->20117 20138 40db27 20139 40d980 4 API calls 20138->20139 20152 40db37 20139->20152 20140 40da4b VirtualQuery 20141 40db07 20140->20141 20140->20142 20141->20138 20143 40d980 4 API calls 20141->20143 20142->20137 20142->20138 20142->20140 20144 40daa0 VirtualProtect 20142->20144 20143->20138 20144->20137 20145 40dae0 GetLastError 20144->20145 20146 40d980 4 API calls 20145->20146 20146->20142 20147 40dd9f 20149 40d980 4 API calls 20147->20149 20148 40dd00 20150 40d9e0 4 API calls 20148->20150 20155 40dccd 20148->20155 20157 40db53 20148->20157 20151 40ddb9 20149->20151 20150->20148 20151->20117 20152->20147 20152->20148 20153 40d9e0 VirtualQuery VirtualProtect GetLastError VirtualProtect 20152->20153 20154 40d980 4 API calls 20152->20154 20152->20155 20152->20157 20153->20152 20154->20152 20156 40dd72 VirtualProtect 20155->20156 20155->20157 20156->20155 20157->20117 20164 40d9f6 20158->20164 20159 40da90 20159->20114 20160 40db27 20161 40d980 7 API calls 20160->20161 20169 40db37 20161->20169 20162 40da4b VirtualQuery 20163 40db07 20162->20163 20162->20164 20163->20160 20165 40d980 7 API calls 20163->20165 20164->20159 20164->20160 20164->20162 20166 40daa0 VirtualProtect 20164->20166 20165->20160 20166->20159 20167 40dae0 GetLastError 20166->20167 20168 40d980 7 API calls 20167->20168 20168->20164 20170 40dd9f 20169->20170 20171 40dd00 20169->20171 20175 40d9e0 7 API calls 20169->20175 20176 40d980 7 API calls 20169->20176 20178 40dccd 20169->20178 20179 40db53 20169->20179 20172 40d980 7 API calls 20170->20172 20173 40d9e0 7 API calls 20171->20173 20171->20178 20171->20179 20174 40ddb9 20172->20174 20173->20171 20174->20114 20175->20169 20176->20169 20177 40dd72 VirtualProtect 20177->20178 20178->20177 20178->20179 20179->20114 20180->20134 20181->20136 20182->20127 20188 408a60 calloc 20183->20188 20185 4015ed 20196 403d60 20185->20196 20187 4013af 20187->20096 20187->20109 20189 408adb 20188->20189 20192 408a88 20188->20192 20189->20185 20190 408ae8 20190->20185 20191 408920 15 API calls 20191->20192 20192->20190 20192->20191 20193 408ab9 20192->20193 20194 408ac0 free 20193->20194 20194->20194 20195 408ad1 free 20194->20195 20195->20189 20197 403d6e 20196->20197 20288 4021e0 calloc 20197->20288 20201 404242 fclose 20203 403ecc 20201->20203 20202 403da0 20202->20203 20303 404670 strcpy strlen 20202->20303 20203->20201 20204 402ed0 12 API calls 20203->20204 20209 404190 20203->20209 20219 403ed4 strcmp 20203->20219 20236 403f11 strcpy 20203->20236 20241 407700 15 API calls 20203->20241 20279 406870 FreeLibrary 20203->20279 20285 406720 4 API calls 20203->20285 20331 403d30 20203->20331 20406 4037a0 20203->20406 20414 408190 20203->20414 20431 407bc0 20203->20431 20443 406980 20203->20443 20204->20203 20206 403dbb 20206->20203 20208 407650 18 API calls 20206->20208 20210 403dea 20208->20210 20425 402220 20209->20425 20213 403f70 20210->20213 20214 403df4 20210->20214 20217 407770 14 API calls 20213->20217 20216 407650 18 API calls 20214->20216 20218 403e00 20216->20218 20220 403f7c 20217->20220 20221 403e37 20218->20221 20225 4041a8 20218->20225 20226 403e18 free 20218->20226 20219->20203 20222 403f2d 20219->20222 20224 4020d0 51 API calls 20220->20224 20227 407770 14 API calls 20221->20227 20334 403cb0 20222->20334 20229 403f8c 20224->20229 20234 403740 12 API calls 20225->20234 20304 407770 20226->20304 20231 403e43 20227->20231 20229->20225 20232 403f94 20229->20232 20307 4020d0 20231->20307 20237 4020d0 51 API calls 20232->20237 20280 404076 20234->20280 20236->20222 20240 403fab 20237->20240 20238 403f3d 20343 406870 20238->20343 20245 403fe0 20240->20245 20246 403faf 20240->20246 20241->20203 20242 40407e 20250 4066e0 15 API calls 20242->20250 20243 4041e2 20256 408b00 12 API calls 20243->20256 20244 403e5b 20251 408b00 12 API calls 20244->20251 20248 4046b0 13 API calls 20245->20248 20247 402ed0 12 API calls 20246->20247 20253 403fcf 20247->20253 20255 403ff0 20248->20255 20249 4020d0 51 API calls 20257 4042bc 20249->20257 20258 403eb0 20250->20258 20252 403e90 20251->20252 20259 404229 20252->20259 20260 403e9f SetDllDirectoryW 20252->20260 20253->20187 20255->20203 20265 408550 11 API calls 20255->20265 20262 404205 20256->20262 20257->20244 20257->20246 20273 403ec0 20258->20273 20353 4061b0 20258->20353 20268 402ed0 12 API calls 20259->20268 20318 4066e0 calloc 20260->20318 20262->20259 20266 404209 SetDllDirectoryW 20262->20266 20264 406720 4 API calls 20269 403f5f 20264->20269 20270 404048 20265->20270 20271 4066e0 15 API calls 20266->20271 20268->20203 20269->20187 20270->20201 20349 403740 20270->20349 20271->20258 20272 4040a4 20272->20273 20275 4040ac 20272->20275 20273->20203 20322 406720 20273->20322 20368 406410 20275->20368 20279->20203 20280->20242 20280->20243 20281 4040bc 20282 4040cc 20281->20282 20396 406670 20281->20396 20282->20203 20284 406870 FreeLibrary 20282->20284 20286 4040e0 20284->20286 20285->20203 20287 406720 4 API calls 20286->20287 20287->20203 20289 4021fb 20288->20289 20290 4021ff 20288->20290 20289->20203 20292 4045d0 20289->20292 20291 403030 14 API calls 20290->20291 20291->20289 20293 40e630 20292->20293 20294 4045db GetModuleFileNameW 20293->20294 20295 404630 20294->20295 20296 404601 20294->20296 20297 402f90 12 API calls 20295->20297 20298 408920 15 API calls 20296->20298 20299 404644 20297->20299 20300 40461c 20298->20300 20299->20202 20301 402ed0 12 API calls 20300->20301 20302 404627 20300->20302 20301->20302 20302->20202 20303->20206 20305 408b00 12 API calls 20304->20305 20306 407791 SetEnvironmentVariableW free 20305->20306 20306->20221 20449 401950 20307->20449 20310 402104 20310->20244 20310->20249 20311 401950 3 API calls 20312 402136 20311->20312 20312->20310 20452 404300 20312->20452 20317 402184 fclose 20317->20310 20319 4066fb 20318->20319 20320 4066ff 20318->20320 20319->20258 20321 403030 14 API calls 20320->20321 20321->20319 20323 40676d 20322->20323 20324 40672f 20322->20324 20323->20203 20325 406741 20324->20325 20326 406739 free 20324->20326 20327 406753 20325->20327 20328 40674b free 20325->20328 20326->20325 20329 406765 free 20327->20329 20330 40675d free 20327->20330 20328->20327 20329->20323 20330->20329 20332 40f100 3 API calls 20331->20332 20333 403d57 20332->20333 20333->20203 20489 4056b0 20334->20489 20342 403cee 20342->20238 20344 406881 20343->20344 20348 403f53 20343->20348 20345 40691e 20344->20345 20344->20348 20846 408160 FreeLibrary 20344->20846 20345->20348 20847 408160 FreeLibrary 20345->20847 20348->20264 20350 403760 20349->20350 20351 403756 20349->20351 20350->20351 20352 401980 12 API calls 20350->20352 20351->20280 20352->20350 20354 4061d3 strncpy strncpy strncpy 20353->20354 20357 406360 20353->20357 20355 4043b0 7 API calls 20354->20355 20359 406243 calloc malloc malloc 20355->20359 20356 406368 20356->20272 20357->20356 20358 406387 20357->20358 20363 401980 12 API calls 20357->20363 20360 4019c0 35 API calls 20358->20360 20361 4062c7 20359->20361 20362 40638c 20359->20362 20360->20362 20361->20362 20365 4062d3 memcpy memcpy memcpy 20361->20365 20362->20356 20364 402ed0 12 API calls 20362->20364 20363->20357 20364->20356 20366 406340 free 20365->20366 20367 40632c 20365->20367 20366->20272 20367->20272 20369 40e630 20368->20369 20370 40641e calloc 20369->20370 20371 406640 strncpy 20370->20371 20376 40644d 20370->20376 20372 4065a0 strncpy 20371->20372 20373 4043b0 7 API calls 20372->20373 20375 4065d7 strncpy 20373->20375 20378 4043b0 7 API calls 20375->20378 20377 406470 memcpy 20376->20377 20379 406534 20376->20379 20380 4064e9 strlen 20376->20380 20393 406620 20376->20393 20884 402310 20376->20884 20381 4043b0 7 API calls 20377->20381 20382 4065fb 20378->20382 20383 402ed0 12 API calls 20379->20383 20380->20376 20386 406568 20380->20386 20384 4064a1 strlen strlen 20381->20384 20889 404380 20382->20889 20387 406549 free 20383->20387 20848 401bd0 20384->20848 20386->20371 20388 406577 20386->20388 20387->20281 20391 4043b0 7 API calls 20388->20391 20390 406607 20392 4043b0 7 API calls 20390->20392 20391->20372 20394 406619 20392->20394 20395 402ed0 12 API calls 20393->20395 20394->20387 20395->20394 20397 408100 14 API calls 20396->20397 20398 406683 20397->20398 20399 408100 14 API calls 20398->20399 20400 406697 20399->20400 20401 4066c0 20400->20401 20402 4066ab 20400->20402 20403 402ed0 12 API calls 20401->20403 20990 406d50 GetProcAddress 20402->20990 20405 4066b7 20403->20405 20405->20282 20407 4037d0 20406->20407 20409 4037d8 20406->20409 20407->20203 20408 401bd0 101 API calls 20408->20409 20409->20408 20411 401980 12 API calls 20409->20411 20412 403822 20409->20412 21084 403370 20409->21084 20411->20409 20412->20407 20413 402220 2 API calls 20412->20413 20413->20412 20415 40819e 20414->20415 20416 408b00 12 API calls 20415->20416 20417 4081cc SetConsoleCtrlHandler GetStartupInfoW 20416->20417 20418 40824b _fileno _get_osfhandle 20417->20418 20419 408274 _fileno _get_osfhandle 20418->20419 20420 408297 _fileno _get_osfhandle GetCommandLineW CreateProcessW 20419->20420 20421 408350 20420->20421 20422 40830e WaitForSingleObject GetExitCodeProcess 20420->20422 20423 402f90 12 API calls 20421->20423 20422->20203 20424 408364 20423->20424 20424->20203 20426 402249 20425->20426 20427 40222c 20425->20427 20426->20187 20428 402233 free 20427->20428 20429 40223b 20427->20429 20428->20429 20429->20426 20430 402241 fclose 20429->20430 20430->20426 20432 407bce 20431->20432 20433 408b00 12 API calls 20432->20433 20434 407bf9 wcscpy wcslen 20433->20434 20435 407c24 20434->20435 20436 407c2e wcscat _wfindfirst 20434->20436 20435->20436 20437 407cd0 wcscat 20435->20437 20438 407c80 20436->20438 20439 407c5e _wrmdir 20436->20439 20437->20436 21185 407cf0 20438->21185 20439->20203 20442 407cb8 _findclose 20442->20439 20444 406996 20443->20444 20445 4069ed 20444->20445 20446 402ed0 12 API calls 20444->20446 20445->20203 20447 406a5e 20446->20447 20448 406870 FreeLibrary 20447->20448 20448->20445 20450 40f100 3 API calls 20449->20450 20451 401977 20450->20451 20451->20310 20451->20311 20453 40430b 20452->20453 20454 4042d0 3 API calls 20453->20454 20455 404334 20454->20455 20456 40214f strcpy 20455->20456 20457 40e900 18 API calls 20455->20457 20460 401e60 20456->20460 20458 404348 20457->20458 20459 4042d0 3 API calls 20458->20459 20459->20456 20461 402020 20460->20461 20462 401e75 20460->20462 20464 4046b0 13 API calls 20461->20464 20463 408550 11 API calls 20462->20463 20474 402014 20462->20474 20465 401eaa 20463->20465 20464->20462 20466 40ef60 6 API calls 20465->20466 20465->20474 20467 401ecc 20466->20467 20468 401ed4 fread 20467->20468 20469 40208f 20467->20469 20471 402061 20468->20471 20472 401efd 20468->20472 20470 403030 14 API calls 20469->20470 20470->20474 20473 403030 14 API calls 20471->20473 20475 40ef60 6 API calls 20472->20475 20473->20474 20474->20310 20474->20317 20476 401f57 malloc 20475->20476 20477 4020a5 20476->20477 20478 401f6d fread 20476->20478 20479 403030 14 API calls 20477->20479 20480 402046 20478->20480 20481 401f8f ferror 20478->20481 20479->20474 20483 403030 14 API calls 20480->20483 20482 40207c 20481->20482 20485 401fac 20481->20485 20484 402ed0 12 API calls 20482->20484 20483->20474 20484->20474 20487 402ed0 12 API calls 20485->20487 20488 401ff6 20485->20488 20486 402006 fclose 20486->20474 20487->20485 20488->20474 20488->20486 20490 4056be 20489->20490 20567 405430 20490->20567 20493 4056f3 20496 4043b0 7 API calls 20493->20496 20514 405701 20493->20514 20494 4057ca 20495 402ed0 12 API calls 20494->20495 20513 403cc0 20495->20513 20499 40576a 20496->20499 20498 405717 20500 402ed0 12 API calls 20498->20500 20504 40571b 20498->20504 20502 402ed0 12 API calls 20499->20502 20506 40576e 20499->20506 20500->20504 20502->20506 20578 408100 20504->20578 20505 405723 20508 4057f0 20505->20508 20509 40572b 20505->20509 20748 4044f0 20506->20748 20507 405776 20512 408100 14 API calls 20507->20512 20507->20514 20511 402f90 12 API calls 20508->20511 20581 404760 GetProcAddress 20509->20581 20511->20513 20512->20514 20513->20342 20515 405a60 20513->20515 20570 4043b0 20514->20570 20516 407650 18 API calls 20515->20516 20517 405a75 20516->20517 20518 405a94 20517->20518 20521 402f30 12 API calls 20517->20521 20519 408b00 12 API calls 20518->20519 20520 405ad7 20519->20520 20522 405ca2 20520->20522 20523 405adf 20520->20523 20521->20518 20524 402ed0 12 API calls 20522->20524 20526 408b00 12 API calls 20523->20526 20525 403cd6 20524->20525 20525->20342 20552 405cf0 strlen 20525->20552 20527 405b0a 20526->20527 20528 405b12 20527->20528 20529 405ccb 20527->20529 20531 405430 3 API calls 20528->20531 20530 402ed0 12 API calls 20529->20530 20530->20525 20532 405b77 20531->20532 20533 405c78 20532->20533 20534 405b8a 20532->20534 20535 402ed0 12 API calls 20533->20535 20536 408b00 12 API calls 20534->20536 20535->20525 20537 405b9e 20536->20537 20538 405cb5 20537->20538 20539 405ba6 20537->20539 20540 402ed0 12 API calls 20538->20540 20752 405490 20539->20752 20540->20525 20542 405bc0 20767 408c20 calloc 20542->20767 20544 405beb 20545 405bf5 20544->20545 20546 405c8f 20544->20546 20548 405c31 free 20545->20548 20549 405c20 free 20545->20549 20547 402ed0 12 API calls 20546->20547 20547->20525 20550 405c3f 20548->20550 20549->20548 20549->20549 20550->20525 20551 402ed0 12 API calls 20550->20551 20551->20525 20553 405d26 20552->20553 20554 405dea 20553->20554 20561 405d2e 20553->20561 20555 402ed0 12 API calls 20554->20555 20556 403ce2 20555->20556 20556->20342 20562 405ed0 20556->20562 20557 401980 12 API calls 20557->20561 20559 402ed0 12 API calls 20559->20561 20560 405dba free 20560->20561 20561->20556 20561->20557 20561->20559 20561->20560 20780 4019c0 20561->20780 20563 405ee8 20562->20563 20564 405ee1 20562->20564 20563->20564 20566 401980 12 API calls 20563->20566 20838 405e00 strlen 20563->20838 20564->20342 20566->20563 20568 40f100 3 API calls 20567->20568 20569 405457 20568->20569 20569->20493 20569->20494 20571 4042d0 3 API calls 20570->20571 20572 4043de 20571->20572 20573 404450 20572->20573 20574 4043fa strlen 20572->20574 20573->20498 20574->20573 20575 40440d 20574->20575 20576 404430 strncat strlen 20575->20576 20577 40441f strncat 20575->20577 20576->20498 20577->20498 20579 408b00 12 API calls 20578->20579 20580 408121 LoadLibraryExW free 20579->20580 20580->20505 20582 404e16 20581->20582 20583 40478c GetProcAddress 20581->20583 20586 402f90 12 API calls 20582->20586 20584 4047a9 GetProcAddress 20583->20584 20585 404dfb 20583->20585 20588 404de0 20584->20588 20589 4047c6 GetProcAddress 20584->20589 20587 402f90 12 API calls 20585->20587 20590 404d9b 20586->20590 20587->20590 20591 402f90 12 API calls 20588->20591 20592 4047e3 GetProcAddress 20589->20592 20593 404eac 20589->20593 20590->20513 20591->20590 20595 404800 GetProcAddress 20592->20595 20596 404e8e 20592->20596 20594 402f90 12 API calls 20593->20594 20594->20590 20598 404e70 20595->20598 20599 40481d GetProcAddress 20595->20599 20597 402f90 12 API calls 20596->20597 20597->20590 20600 402f90 12 API calls 20598->20600 20601 404e52 20599->20601 20602 40483a GetProcAddress 20599->20602 20600->20590 20603 402f90 12 API calls 20601->20603 20604 404e34 20602->20604 20605 404857 GetProcAddress 20602->20605 20603->20590 20606 402f90 12 API calls 20604->20606 20607 4053f2 20605->20607 20608 404874 20605->20608 20606->20590 20609 402f90 12 API calls 20607->20609 20610 404882 GetProcAddress 20608->20610 20611 404da8 GetProcAddress 20608->20611 20609->20590 20612 404f24 20610->20612 20613 40489f GetProcAddress 20610->20613 20611->20610 20614 404dc5 20611->20614 20617 402f90 12 API calls 20612->20617 20615 404f06 20613->20615 20616 4048bc GetProcAddress 20613->20616 20618 402f90 12 API calls 20614->20618 20619 402f90 12 API calls 20615->20619 20620 404ee8 20616->20620 20621 4048d9 GetProcAddress 20616->20621 20617->20590 20618->20590 20619->20590 20624 402f90 12 API calls 20620->20624 20622 4048f6 GetProcAddress 20621->20622 20623 404eca 20621->20623 20625 404913 GetProcAddress 20622->20625 20626 404f9c 20622->20626 20627 402f90 12 API calls 20623->20627 20624->20590 20629 404930 GetProcAddress 20625->20629 20630 404f7e 20625->20630 20628 402f90 12 API calls 20626->20628 20627->20590 20628->20590 20631 404f60 20629->20631 20632 40494d GetProcAddress 20629->20632 20633 402f90 12 API calls 20630->20633 20636 402f90 12 API calls 20631->20636 20634 404f42 20632->20634 20635 40496a GetProcAddress 20632->20635 20633->20590 20637 402f90 12 API calls 20634->20637 20638 404987 GetProcAddress 20635->20638 20639 404fd8 20635->20639 20636->20590 20637->20590 20641 4049a4 GetProcAddress 20638->20641 20642 404fba 20638->20642 20640 402f90 12 API calls 20639->20640 20640->20590 20644 4049c1 GetProcAddress 20641->20644 20645 405014 20641->20645 20643 402f90 12 API calls 20642->20643 20643->20590 20646 404ff6 20644->20646 20647 4049de GetProcAddress 20644->20647 20648 402f90 12 API calls 20645->20648 20649 402f90 12 API calls 20646->20649 20650 4049fb GetProcAddress 20647->20650 20651 40506e 20647->20651 20648->20590 20649->20590 20653 405050 20650->20653 20654 404a18 GetProcAddress 20650->20654 20652 402f90 12 API calls 20651->20652 20652->20590 20655 402f90 12 API calls 20653->20655 20656 405032 20654->20656 20657 404a35 GetProcAddress 20654->20657 20655->20590 20658 402f90 12 API calls 20656->20658 20659 404a52 GetProcAddress 20657->20659 20660 40508c 20657->20660 20658->20590 20661 405122 20659->20661 20662 404a6f GetProcAddress 20659->20662 20663 402f90 12 API calls 20660->20663 20666 402f90 12 API calls 20661->20666 20664 405104 20662->20664 20665 404a8c GetProcAddress 20662->20665 20663->20590 20669 402f90 12 API calls 20664->20669 20667 4050e6 20665->20667 20668 404aa9 GetProcAddress 20665->20668 20666->20590 20670 402f90 12 API calls 20667->20670 20671 404ac6 GetProcAddress 20668->20671 20672 4050c8 20668->20672 20669->20590 20670->20590 20673 404ae3 GetProcAddress 20671->20673 20674 4050aa 20671->20674 20675 402f90 12 API calls 20672->20675 20676 405140 20673->20676 20677 404b00 GetProcAddress 20673->20677 20678 402f90 12 API calls 20674->20678 20675->20590 20681 402f90 12 API calls 20676->20681 20679 40517c 20677->20679 20680 404b1d GetProcAddress 20677->20680 20678->20590 20682 402f90 12 API calls 20679->20682 20683 404b3a GetProcAddress 20680->20683 20684 40515e 20680->20684 20681->20590 20682->20590 20685 404b57 GetProcAddress 20683->20685 20686 4051b8 20683->20686 20687 402f90 12 API calls 20684->20687 20689 404b74 GetProcAddress 20685->20689 20690 40519a 20685->20690 20688 402f90 12 API calls 20686->20688 20687->20590 20688->20590 20692 404b91 GetProcAddress 20689->20692 20693 4051f4 20689->20693 20691 402f90 12 API calls 20690->20691 20691->20590 20694 4051d6 20692->20694 20695 404bae GetProcAddress 20692->20695 20696 402f90 12 API calls 20693->20696 20697 402f90 12 API calls 20694->20697 20698 404bcb GetProcAddress 20695->20698 20699 40526c 20695->20699 20696->20590 20697->20590 20701 404be8 GetProcAddress 20698->20701 20702 40524e 20698->20702 20700 402f90 12 API calls 20699->20700 20700->20590 20704 405230 20701->20704 20705 404c05 GetProcAddress 20701->20705 20703 402f90 12 API calls 20702->20703 20703->20590 20708 402f90 12 API calls 20704->20708 20706 405212 20705->20706 20707 404c22 GetProcAddress 20705->20707 20709 402f90 12 API calls 20706->20709 20710 405320 20707->20710 20711 404c3f GetProcAddress 20707->20711 20708->20590 20709->20590 20714 402f90 12 API calls 20710->20714 20712 405302 20711->20712 20713 404c5c GetProcAddress 20711->20713 20717 402f90 12 API calls 20712->20717 20715 4052e4 20713->20715 20716 404c79 GetProcAddress 20713->20716 20714->20590 20720 402f90 12 API calls 20715->20720 20718 4052c6 20716->20718 20719 404c96 GetProcAddress 20716->20719 20717->20590 20721 402f90 12 API calls 20718->20721 20722 404cb3 GetProcAddress 20719->20722 20723 4052a8 20719->20723 20720->20590 20721->20590 20724 404cd0 GetProcAddress 20722->20724 20725 40528a 20722->20725 20726 402f90 12 API calls 20723->20726 20727 4053d4 20724->20727 20728 404ced GetProcAddress 20724->20728 20729 402f90 12 API calls 20725->20729 20726->20590 20732 402f90 12 API calls 20727->20732 20730 4053b6 20728->20730 20731 404d0a GetProcAddress 20728->20731 20729->20590 20735 402f90 12 API calls 20730->20735 20733 404d27 GetProcAddress 20731->20733 20734 405398 20731->20734 20732->20590 20737 404d44 GetProcAddress 20733->20737 20738 40537a 20733->20738 20736 402f90 12 API calls 20734->20736 20735->20590 20736->20590 20740 404d61 GetProcAddress 20737->20740 20741 40535c 20737->20741 20739 402f90 12 API calls 20738->20739 20739->20590 20743 40533e 20740->20743 20744 404d7e GetProcAddress 20740->20744 20742 402f90 12 API calls 20741->20742 20742->20590 20746 402f90 12 API calls 20743->20746 20744->20590 20745 405410 20744->20745 20747 402f90 12 API calls 20745->20747 20746->20590 20747->20590 20749 4044fb 20748->20749 20750 408b00 12 API calls 20749->20750 20751 40451c _wstat 20750->20751 20751->20507 20753 40549f 20752->20753 20755 4055b0 20753->20755 20756 405504 mbstowcs 20753->20756 20761 4055b8 20753->20761 20775 401980 20753->20775 20758 4055d7 _fileno _setmode 20755->20758 20755->20761 20756->20753 20757 405693 20756->20757 20759 402ed0 12 API calls 20757->20759 20760 4055fb _fileno _setmode 20758->20760 20759->20761 20762 405619 fflush 20760->20762 20761->20542 20763 40562a fflush 20762->20763 20764 40563b setbuf 20763->20764 20765 405654 setbuf 20764->20765 20766 40566d setbuf 20765->20766 20766->20542 20768 408c9b 20767->20768 20771 408c48 20767->20771 20768->20544 20769 408ca8 20769->20544 20770 408b00 12 API calls 20770->20771 20771->20769 20771->20770 20772 408c79 20771->20772 20773 408c80 free 20772->20773 20773->20773 20774 408c91 free 20773->20774 20774->20768 20776 4019a0 20775->20776 20777 401993 20775->20777 20778 402ed0 12 API calls 20776->20778 20777->20753 20779 4019ac 20778->20779 20779->20753 20781 401b30 20780->20781 20782 4019d9 20780->20782 20783 4046b0 13 API calls 20781->20783 20784 40ef60 6 API calls 20782->20784 20785 401b43 20783->20785 20786 4019fb 20784->20786 20785->20782 20787 401b51 20785->20787 20788 401b70 20786->20788 20789 401a07 malloc 20786->20789 20790 402ed0 12 API calls 20787->20790 20791 403030 14 API calls 20788->20791 20792 401a1e 20789->20792 20793 401b9f 20789->20793 20794 401af0 20790->20794 20795 401b8b 20791->20795 20797 401b00 20792->20797 20802 401a2c 20792->20802 20796 403030 14 API calls 20793->20796 20794->20561 20795->20561 20804 401adc 20796->20804 20807 401610 20797->20807 20799 401ae2 fclose 20799->20794 20800 401b14 20803 401ac8 free 20800->20803 20800->20804 20801 401a73 fread 20801->20802 20805 401aa5 20801->20805 20802->20801 20802->20804 20803->20804 20804->20794 20804->20799 20806 403030 14 API calls 20805->20806 20806->20803 20831 40a4f0 20807->20831 20810 401672 malloc 20812 401688 malloc 20810->20812 20813 401919 20810->20813 20811 4018d4 20814 402ed0 12 API calls 20811->20814 20815 4018f9 20812->20815 20825 4016a4 20812->20825 20817 403030 14 API calls 20813->20817 20816 401846 20814->20816 20818 403030 14 API calls 20815->20818 20816->20800 20819 401938 20817->20819 20822 401826 20818->20822 20820 4016d5 fread 20820->20822 20823 401701 ferror 20820->20823 20821 401858 20821->20800 20824 401832 free free 20822->20824 20823->20822 20823->20825 20824->20816 20825->20820 20825->20821 20825->20822 20827 401770 fwrite 20825->20827 20829 40187f memcpy 20825->20829 20830 4017e9 20825->20830 20826 402ed0 12 API calls 20826->20822 20828 40179c ferror 20827->20828 20827->20830 20828->20825 20828->20830 20829->20822 20829->20825 20830->20822 20830->20826 20834 40a3f0 20831->20834 20833 401668 20833->20810 20833->20811 20835 40a405 20834->20835 20837 40a45c 20834->20837 20836 40a43d malloc 20835->20836 20835->20837 20836->20837 20837->20833 20839 405e41 20838->20839 20840 405eab 20839->20840 20842 405e78 20839->20842 20841 402ed0 12 API calls 20840->20841 20843 405e89 20841->20843 20842->20843 20844 402ed0 12 API calls 20842->20844 20843->20563 20845 405ea0 20844->20845 20845->20563 20846->20345 20847->20348 20892 407b50 20848->20892 20850 401be7 20851 401d68 20850->20851 20901 407dd0 20850->20901 20851->20376 20853 401c0b 20854 401e16 20853->20854 20855 401c17 20853->20855 20857 403030 14 API calls 20854->20857 20856 401c22 20855->20856 20858 4046b0 13 API calls 20855->20858 20859 40ef60 6 API calls 20856->20859 20857->20851 20860 401d93 20858->20860 20861 401c3c 20859->20861 20860->20856 20862 401da0 20860->20862 20863 401df0 20861->20863 20864 401c44 20861->20864 20865 402ed0 12 API calls 20862->20865 20866 403030 14 API calls 20863->20866 20867 401d30 20864->20867 20868 401c4e malloc 20864->20868 20873 401d44 20865->20873 20866->20873 20870 401610 24 API calls 20867->20870 20869 401e3c 20868->20869 20871 401c64 20868->20871 20872 403030 14 API calls 20869->20872 20870->20873 20874 401cda fread 20871->20874 20883 401c6d 20871->20883 20872->20873 20875 401d5c fclose 20873->20875 20876 401d4d fclose 20873->20876 20878 401d01 20874->20878 20879 401c78 fwrite 20874->20879 20875->20851 20876->20875 20877 401d22 free 20877->20873 20881 403030 14 API calls 20878->20881 20879->20871 20880 401dc0 20879->20880 20882 403030 14 API calls 20880->20882 20881->20877 20882->20883 20883->20877 20885 402328 20884->20885 20886 40235b 20885->20886 20887 40232c strcmp 20885->20887 20888 402ed0 12 API calls 20885->20888 20886->20376 20887->20885 20887->20886 20888->20885 20973 40e660 setlocale 20889->20973 20893 407b70 20892->20893 20894 407b64 20892->20894 20931 402270 strlen 20893->20931 20894->20850 20896 407b80 20937 407940 20896->20937 20898 407b92 20899 407b96 20898->20899 20900 402ed0 12 API calls 20898->20900 20899->20850 20900->20894 20902 407dde 20901->20902 20903 4074f0 3 API calls 20902->20903 20904 407e07 20903->20904 20905 407f05 20904->20905 20906 4074f0 3 API calls 20904->20906 20905->20853 20907 407e3c 20906->20907 20907->20905 20908 407e47 strlen strtok 20907->20908 20909 407f18 20908->20909 20910 407e6b 20908->20910 20911 408b00 12 API calls 20909->20911 20912 407e78 strlen 20910->20912 20929 408d40 13 API calls 20910->20929 20913 407f33 _wstat 20911->20913 20912->20905 20914 407e8c strlen strcpy strtok 20912->20914 20915 407f67 20913->20915 20916 407f48 20913->20916 20914->20909 20917 407ec2 20914->20917 20919 4046b0 13 API calls 20915->20919 20918 407f53 20916->20918 20925 407650 18 API calls 20916->20925 20920 408b00 12 API calls 20917->20920 20921 407ef5 20918->20921 20922 407f57 20918->20922 20923 407f77 20919->20923 20924 407ed6 _wstat 20920->20924 20926 402f30 12 API calls 20921->20926 20927 402f30 12 API calls 20922->20927 20923->20853 20924->20910 20924->20912 20928 407f8e 20925->20928 20926->20905 20927->20915 20928->20922 20930 407f9e free 20928->20930 20929->20910 20930->20918 20932 402298 20931->20932 20933 4022be 20932->20933 20934 4022d0 strncmp 20932->20934 20936 402ed0 12 API calls 20932->20936 20933->20896 20934->20932 20935 4022ef 20934->20935 20935->20896 20936->20932 20938 40794e 20937->20938 20939 4079a7 GetTempPathW _getpid 20938->20939 20940 40795b 20938->20940 20941 4074c0 7 API calls 20939->20941 20942 407650 18 API calls 20940->20942 20943 4079e9 _wtempnam 20941->20943 20944 407967 20942->20944 20945 408d40 13 API calls 20943->20945 20946 4077c0 23 API calls 20944->20946 20947 407a00 20945->20947 20948 40797a 20946->20948 20949 407ab0 20947->20949 20950 407a08 free 20947->20950 20951 407984 _wputenv_s free 20948->20951 20952 407a8a 20948->20952 20954 408920 15 API calls 20949->20954 20950->20943 20955 407a15 20950->20955 20951->20939 20953 407aa0 20951->20953 20952->20898 20956 402ed0 12 API calls 20953->20956 20957 407ad0 free 20954->20957 20955->20952 20961 407a50 20955->20961 20962 407a28 20955->20962 20958 407aae 20956->20958 20959 407a42 20957->20959 20960 407ae7 20957->20960 20958->20959 20959->20898 20963 407b0c 20960->20963 20964 407aef 20960->20964 20966 408b00 12 API calls 20961->20966 20965 407700 15 API calls 20962->20965 20969 408b00 12 API calls 20963->20969 20967 407700 15 API calls 20964->20967 20968 407a3a free 20965->20968 20970 407a6c SetEnvironmentVariableW free 20966->20970 20971 407aff free 20967->20971 20968->20959 20972 407b28 SetEnvironmentVariableW free 20969->20972 20970->20952 20971->20959 20972->20959 20974 40e690 setlocale 20973->20974 20975 40e686 _strdup 20973->20975 20976 40e6a8 20974->20976 20977 40e6ad wcstombs realloc wcstombs setlocale free 20974->20977 20975->20974 20976->20977 20978 40e720 mbstowcs 20976->20978 20979 40438f strcpy 20977->20979 20980 40e630 20978->20980 20979->20390 20981 40e74c mbstowcs 20980->20981 20982 40e76b 20981->20982 20983 40e783 20982->20983 20984 40e790 20982->20984 20983->20977 20985 40e890 wcstombs realloc wcstombs 20984->20985 20986 40e80d wcstombs 20984->20986 20987 40e8db setlocale free 20985->20987 20988 40e822 20986->20988 20989 40e826 wcstombs 20986->20989 20987->20979 20988->20989 20989->20987 20991 4070f0 20990->20991 20992 406d81 GetProcAddress 20990->20992 20993 402f90 12 API calls 20991->20993 20994 407126 20992->20994 20995 406d9e GetProcAddress 20992->20995 21021 4070e7 20993->21021 20998 402f90 12 API calls 20994->20998 20996 40710b 20995->20996 20997 406dbb GetProcAddress 20995->20997 21001 402f90 12 API calls 20996->21001 20999 406dd8 GetProcAddress 20997->20999 21000 40715c 20997->21000 20998->21021 21002 407141 20999->21002 21003 406df5 GetProcAddress 20999->21003 21004 402f90 12 API calls 21000->21004 21001->21021 21007 402f90 12 API calls 21002->21007 21005 406e12 GetProcAddress 21003->21005 21006 4071b6 21003->21006 21004->21021 21008 407198 21005->21008 21009 406e2f GetProcAddress 21005->21009 21010 402f90 12 API calls 21006->21010 21007->21021 21011 402f90 12 API calls 21008->21011 21012 40717a 21009->21012 21013 406e4c GetProcAddress 21009->21013 21010->21021 21011->21021 21014 402f90 12 API calls 21012->21014 21015 4071d4 21013->21015 21016 406e69 GetProcAddress 21013->21016 21014->21021 21017 402f90 12 API calls 21015->21017 21018 406e86 GetProcAddress 21016->21018 21019 40724c 21016->21019 21017->21021 21022 406ea3 GetProcAddress 21018->21022 21023 40722e 21018->21023 21020 402f90 12 API calls 21019->21020 21020->21021 21021->20405 21025 407210 21022->21025 21026 406ec0 GetProcAddress 21022->21026 21024 402f90 12 API calls 21023->21024 21024->21021 21027 402f90 12 API calls 21025->21027 21028 4071f2 21026->21028 21029 406edd GetProcAddress 21026->21029 21027->21021 21030 402f90 12 API calls 21028->21030 21031 4072c4 21029->21031 21032 406efa GetProcAddress 21029->21032 21030->21021 21033 402f90 12 API calls 21031->21033 21034 4072a6 21032->21034 21035 406f17 GetProcAddress 21032->21035 21033->21021 21038 402f90 12 API calls 21034->21038 21036 406f34 GetProcAddress 21035->21036 21037 407288 21035->21037 21039 406f51 GetProcAddress 21036->21039 21040 40726a 21036->21040 21041 402f90 12 API calls 21037->21041 21038->21021 21042 4072e2 21039->21042 21043 406f6e GetProcAddress 21039->21043 21044 402f90 12 API calls 21040->21044 21041->21021 21047 402f90 12 API calls 21042->21047 21045 407300 21043->21045 21046 406f8b GetProcAddress 21043->21046 21044->21021 21050 402f90 12 API calls 21045->21050 21048 406fa8 GetProcAddress 21046->21048 21049 40733c 21046->21049 21047->21021 21051 406fc5 GetProcAddress 21048->21051 21052 40731e 21048->21052 21053 402f90 12 API calls 21049->21053 21050->21021 21054 406fe2 GetProcAddress 21051->21054 21055 407396 21051->21055 21056 402f90 12 API calls 21052->21056 21053->21021 21057 407378 21054->21057 21058 406fff GetProcAddress 21054->21058 21059 402f90 12 API calls 21055->21059 21056->21021 21060 402f90 12 API calls 21057->21060 21061 40735a 21058->21061 21062 40701c GetProcAddress 21058->21062 21059->21021 21060->21021 21063 402f90 12 API calls 21061->21063 21064 4073b4 21062->21064 21065 407039 GetProcAddress 21062->21065 21063->21021 21066 402f90 12 API calls 21064->21066 21067 407056 GetProcAddress 21065->21067 21068 40742c 21065->21068 21066->21021 21070 407073 GetProcAddress 21067->21070 21071 40740e 21067->21071 21069 402f90 12 API calls 21068->21069 21069->21021 21073 4073f0 21070->21073 21074 407090 GetProcAddress 21070->21074 21072 402f90 12 API calls 21071->21072 21072->21021 21075 402f90 12 API calls 21073->21075 21076 4073d2 21074->21076 21077 4070ad GetProcAddress 21074->21077 21075->21021 21078 402f90 12 API calls 21076->21078 21079 40744a 21077->21079 21080 4070ca GetProcAddress 21077->21080 21078->21021 21081 402f90 12 API calls 21079->21081 21080->21021 21082 407468 21080->21082 21081->21021 21083 402f90 12 API calls 21082->21083 21083->21021 21085 40337f 21084->21085 21141 4032f0 21085->21141 21088 403439 21088->20409 21089 404300 21 API calls 21090 4033c1 21089->21090 21147 4032a0 21090->21147 21093 403402 21094 407b50 67 API calls 21093->21094 21096 40340a 21094->21096 21095 4032a0 9 API calls 21097 403497 21095->21097 21098 403430 21096->21098 21152 407fd0 21096->21152 21097->21093 21099 40349f 21097->21099 21098->21088 21101 402ed0 12 API calls 21098->21101 21100 4032a0 9 API calls 21099->21100 21103 4034ca 21100->21103 21101->21088 21104 4034d2 21103->21104 21106 4032a0 9 API calls 21103->21106 21105 407b50 67 API calls 21104->21105 21140 4035dc 21104->21140 21112 4034e0 21105->21112 21107 4035a8 21106->21107 21107->21104 21110 4032a0 9 API calls 21107->21110 21108 402ed0 12 API calls 21108->21088 21109 4035e8 21114 4021e0 15 API calls 21109->21114 21110->21104 21111 403510 strcmp 21111->21112 21113 403523 21111->21113 21112->21109 21112->21111 21112->21140 21115 40352b 21113->21115 21116 40353c strcmp 21113->21116 21122 401980 12 API calls 21113->21122 21117 4035f9 21114->21117 21115->21088 21121 402ed0 12 API calls 21115->21121 21116->21113 21118 403556 21116->21118 21117->21140 21173 403270 21117->21173 21119 401bd0 101 API calls 21118->21119 21119->21115 21124 403574 21121->21124 21122->21113 21124->20409 21125 4036d0 21127 402ed0 12 API calls 21125->21127 21126 403270 3 API calls 21130 403667 21126->21130 21128 4036dc 21127->21128 21129 402220 2 API calls 21128->21129 21129->21140 21130->21125 21131 403270 3 API calls 21130->21131 21132 40369c 21131->21132 21132->21125 21133 4036a3 21132->21133 21134 401e60 31 API calls 21133->21134 21135 4036ba 21134->21135 21136 4036c2 21135->21136 21137 402ed0 12 API calls 21135->21137 21136->20409 21138 403728 21137->21138 21139 402220 2 API calls 21138->21139 21139->21140 21140->21108 21142 403270 3 API calls 21141->21142 21143 40331d 21142->21143 21144 403324 strchr 21143->21144 21146 40334f 21143->21146 21145 403338 strcpy 21144->21145 21144->21146 21145->21146 21146->21088 21146->21089 21148 40f100 3 API calls 21147->21148 21149 4032c8 21148->21149 21150 4032df 21149->21150 21176 40ed40 21149->21176 21150->21093 21150->21095 21153 407fdd 21152->21153 21154 4046b0 13 API calls 21153->21154 21155 407ff6 21154->21155 21156 407dd0 41 API calls 21155->21156 21157 408012 21156->21157 21158 4080e8 21157->21158 21159 408024 21157->21159 21160 4080dc 21157->21160 21161 4080bd fclose 21158->21161 21162 4080c5 21158->21162 21163 408030 feof 21159->21163 21160->21158 21164 4080e0 fclose 21160->21164 21161->21162 21162->21098 21165 408040 fread 21163->21165 21166 4080d8 21163->21166 21164->21158 21168 408080 fwrite 21165->21168 21169 408060 ferror 21165->21169 21167 4080b5 fclose 21166->21167 21167->21161 21170 4080a8 clearerr 21168->21170 21171 40809c ferror 21168->21171 21169->21163 21172 40806c clearerr 21169->21172 21170->21167 21171->21163 21171->21170 21172->21167 21172->21168 21174 40f100 3 API calls 21173->21174 21175 403297 21174->21175 21175->21125 21175->21126 21177 40ed53 21176->21177 21178 40ed5c _stat 21176->21178 21177->21178 21179 40edc0 strlen 21177->21179 21180 40ed6e 21178->21180 21179->21178 21181 40edcf 21179->21181 21180->21150 21181->21178 21182 40edf5 malloc memcpy _stat 21181->21182 21184 40ee4e 21181->21184 21182->21180 21183 40ee36 free 21182->21183 21183->21180 21184->21178 21186 40e630 21185->21186 21187 407cfe wcscmp 21186->21187 21188 407d30 wcscmp 21187->21188 21200 407c99 _wfindnext 21187->21200 21189 407d44 wcscat 21188->21189 21188->21200 21190 407d90 _wremove 21189->21190 21191 407d63 21189->21191 21193 407d9c Sleep _wremove 21190->21193 21190->21200 21201 408f20 FindFirstFileExW 21191->21201 21193->21200 21195 407dc0 _wrmdir 21195->21200 21196 407d6c 21197 408920 15 API calls 21196->21197 21198 407d84 21197->21198 21199 407bc0 25 API calls 21198->21199 21199->21200 21200->20438 21200->20442 21202 408f66 FindClose 21201->21202 21203 407d68 21201->21203 21202->21203 21203->21195 21203->21196 21204 4017f4 21211 4016b1 21204->21211 21205 4017e9 21209 401826 21205->21209 21210 402ed0 12 API calls 21205->21210 21206 401770 fwrite 21206->21205 21207 40179c ferror 21206->21207 21207->21205 21207->21211 21208 40187f memcpy 21208->21209 21208->21211 21212 401832 free free 21209->21212 21210->21209 21211->21205 21211->21206 21211->21208 21211->21209 21214 4016d5 fread 21211->21214 21215 401858 21211->21215 21213 401846 21212->21213 21214->21209 21216 401701 ferror 21214->21216 21216->21209 21216->21211 21217 4018b6 21218 401826 21217->21218 21219 401832 free free 21218->21219 21220 401846 21219->21220 21221 408e58 21222 408e60 GetTokenInformation 21221->21222 21223 408ea1 calloc 21222->21223 21224 408e92 GetLastError 21222->21224 21225 408d96 21223->21225 21226 408ec3 GetTokenInformation 21223->21226 21224->21223 21224->21225 21227 408d9c free 21225->21227 21226->21227 21228 408eeb ConvertSidToStringSidW 21226->21228 21229 408db9 _snwprintf LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 21227->21229 21230 408dad FindCloseChangeNotification 21227->21230 21228->21227 21231 408e4d 21229->21231 21232 408e2c CreateDirectoryW 21229->21232 21230->21229 21232->21231

                                          Executed Functions

                                          Function 0040117C Relevance: 18.2, APIs: 12, Instructions: 206sleepCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 323 40117c-40119a 324 4011a0-4011b1 323->324 325 401451-40145a GetStartupInfoW 323->325 326 4011cc-4011d8 324->326 329 401462-401477 _cexit 325->329 327 4011b8-4011ba 326->327 328 4011da-4011e4 326->328 332 4011c0-4011c9 Sleep 327->332 333 4013f3-401400 327->333 330 401406-40141a _amsg_exit 328->330 331 4011ea-4011f1 328->331 334 401420-401440 _initterm 330->334 335 40120f-401211 330->335 336 4011f7-401209 331->336 337 401478-401491 _initterm 331->337 332->326 333->330 333->331 338 401446-40144c 334->338 339 401217-40121e 334->339 335->338 335->339 336->334 336->335 342 40149b 337->342 338->339 340 401220-401239 339->340 341 40123c-40127c call 40db40 SetUnhandledExceptionFilter call 4173c0 call 40d970 __p__wcmdln 339->341 340->341 351 401292-401299 341->351 352 40127e 341->352 345 4014a3-4014af exit 342->345 354 401280-401283 351->354 355 40129b-4012a7 351->355 353 4012cd-4012d5 352->353 356 4012d7-4012e0 353->356 357 4012eb-40130b malloc 353->357 358 401285-401288 354->358 359 4012a9-4012b0 354->359 360 40128f 355->360 361 4012e6 356->361 362 4013ea 356->362 357->342 364 401311-40131d 357->364 358->359 363 40128a 358->363 365 4012b2 359->365 366 4012c8 359->366 360->351 361->357 362->333 363->360 367 401320-401326 364->367 368 4012b8-4012c6 365->368 366->353 369 4013e0-4013e5 367->369 370 40132c-401331 367->370 368->366 368->368 372 401346-40136d malloc memcpy 369->372 371 401338-401341 370->371 371->371 373 401343 371->373 372->367 374 40136f-4013bc call 40d770 call 40d7a0 372->374 373->372 374->345 379 4013c2-4013ca 374->379 379->329 380 4013d0-4013db 379->380
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__wcmdlnmemcpy
                                          • String ID:
                                          • API String ID: 1204267290-0
                                          • Opcode ID: eac8becde6c0dd191b15aea711b8aa84f0afa324810f6ed2f537ece7752c968d
                                          • Instruction ID: 676354774380156a6d31bcdc11651c5caae96c91ab7a06ee3bbcf8190cbc5d75
                                          • Opcode Fuzzy Hash: eac8becde6c0dd191b15aea711b8aa84f0afa324810f6ed2f537ece7752c968d
                                          • Instruction Fuzzy Hash: BF81AF70A042018FDB24EFA4D98576A77F0FB44304F51453EDA85AB3B1D7789885CB8A
                                          Function 00401BD0 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 151COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E4A
                                            • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407E5C
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E7B
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E8F
                                            • Part of subcall function 00407DD0: strcpy.MSVCRT(?,?,00000000), ref: 00407EA3
                                            • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407EB7
                                            • Part of subcall function 00407DD0: _wstat.MSVCRT ref: 00407EE1
                                          • malloc.MSVCRT ref: 00401C55
                                          • fread.MSVCRT ref: 00401CF4
                                          • free.MSVCRT ref: 00401D25
                                          • fclose.MSVCRT ref: 00401D50
                                          • fclose.MSVCRT ref: 00401D63
                                          Strings
                                          • Failed to extract %s: failed to read data chunk!, xrefs: 00401D05
                                          • fseek, xrefs: 00401E01
                                          • fwrite, xrefs: 00401DD1
                                          • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401DF4
                                          • Failed to extract %s: failed to open target file!, xrefs: 00401E1A
                                          • fopen, xrefs: 00401E27
                                          • Failed to extract %s: failed to open archive file!, xrefs: 00401DA4
                                          • fread, xrefs: 00401D12
                                          • Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00401E40
                                          • Failed to extract %s: failed to write data chunk!, xrefs: 00401DC4
                                          • malloc, xrefs: 00401E4B
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlen$fclosestrtok$_wstatfreadfreemallocstrcpy
                                          • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                          • API String ID: 3544345225-666925554
                                          • Opcode ID: 4440eb1eb03a3154bd87365db13383f04021bbf881c10f7881478c95f5f3f3c7
                                          • Instruction ID: b5f998b2d191bd7786349188155599ad4440f4e1001f158a4c3b14c5a7e7e59c
                                          • Opcode Fuzzy Hash: 4440eb1eb03a3154bd87365db13383f04021bbf881c10f7881478c95f5f3f3c7
                                          • Instruction Fuzzy Hash: 5C510AB05093419BD710EF29C48465FBBE1BF84354F118D2EF8E59B391D778E8858B4A
                                          Function 00407940 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 126COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • _wputenv_s.MSVCRT ref: 0040798F
                                          • free.MSVCRT ref: 0040799A
                                          • GetTempPathW.KERNEL32(?,00000000,?,?,00407B92), ref: 004079BB
                                          • _getpid.MSVCRT ref: 004079C4
                                          • _wtempnam.MSVCRT ref: 004079F0
                                          • free.MSVCRT ref: 00407A0B
                                          • free.MSVCRT ref: 00407A3D
                                            • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                            • Part of subcall function 004077C0: ExpandEnvironmentStringsW.KERNEL32(?,00000000,?,?,0040797A,?,00000000,?,?,00407B92), ref: 0040780C
                                            • Part of subcall function 004077C0: free.MSVCRT ref: 0040781A
                                            • Part of subcall function 004077C0: _wfullpath.MSVCRT ref: 0040784A
                                            • Part of subcall function 004077C0: wcschr.MSVCRT ref: 00407877
                                            • Part of subcall function 004077C0: wcsncpy.MSVCRT ref: 004078A7
                                            • Part of subcall function 004077C0: CreateDirectoryW.KERNEL32 ref: 004078B7
                                            • Part of subcall function 004077C0: wcschr.MSVCRT ref: 004078C7
                                            • Part of subcall function 004077C0: CreateDirectoryW.KERNEL32 ref: 004078DD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$CreateDirectoryEnvironmentwcschr$ExpandPathStringsTempVariable_getpid_wfullpath_wputenv_s_wtempnamwcsncpy
                                          • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                          • API String ID: 2180377646-1116378104
                                          • Opcode ID: 927dc99b90c32e611f2856e2e49529ac9b62f84a9827835374f0d536856b72f9
                                          • Instruction ID: 01c5aea6ddf612d932d95327d8216bd8a762320b70d46ed771eeb73c9fc8ba7f
                                          • Opcode Fuzzy Hash: 927dc99b90c32e611f2856e2e49529ac9b62f84a9827835374f0d536856b72f9
                                          • Instruction Fuzzy Hash: 8E41CCB1A0D7008FD710BF65E58536FBBE0AF84744F02882EE5C897242D77D94859B9B
                                          Function 00401610 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 186fileCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 86 401610-40166c call 40a4f0 89 401672-401682 malloc 86->89 90 4018d4-4018f4 call 402ed0 86->90 91 401688-40169e malloc 89->91 92 401919-401938 call 403030 89->92 99 401846-401852 90->99 94 4016a4-4016ad 91->94 95 4018f9-401914 call 403030 91->95 98 4016b1-4016cf 94->98 107 401826-401841 call 40c7c0 free * 2 95->107 102 4016d5-4016fb fread 98->102 103 401858-401868 98->103 105 4018c0-4018c5 102->105 106 401701-40170f ferror 102->106 105->107 106->105 108 401715-40171d 106->108 107->99 110 401721-40174a call 40a5c0 108->110 114 401750-401753 110->114 115 4017f8-4017fb 110->115 117 401759-40176a 114->117 118 401806-40181d 114->118 116 401801 115->116 115->117 116->118 120 401870-401879 117->120 121 401770-401796 fwrite 117->121 118->107 119 401821 call 402ed0 118->119 119->107 124 4017b4-4017b6 120->124 125 40187f-4018b1 memcpy 120->125 122 4018ca-4018cf 121->122 123 40179c-4017aa ferror 121->123 122->118 123->122 126 4017b0 123->126 124->110 127 4017bc-4017dd 124->127 125->105 125->124 126->124 127->107 128 4017df-4017e3 127->128 128->98 129 4017e9-4017f0 128->129 129->107 130 4017f2 129->130 130->118
                                          APIs
                                          Strings
                                          • Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 004018E1
                                          • Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 0040191D
                                          • Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 004018FC
                                          • Failed to extract %s: decompression resulted in return code %d!, xrefs: 00401813
                                          • 1.2.13, xrefs: 00401628
                                          • 8, xrefs: 00401620
                                          • malloc, xrefs: 00401908, 00401925
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ferrorfreemalloc$freadfwritememcpy
                                          • String ID: 1.2.13$8$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                          • API String ID: 3882407908-2046485118
                                          • Opcode ID: 5aace083163d09cb8bea982305f06aca8e3756abcd3827cc7d3909b427364719
                                          • Instruction ID: 36ffe3033784580453c6a567143783feaca3ec72a60cee7d1f4dfc22211088d5
                                          • Opcode Fuzzy Hash: 5aace083163d09cb8bea982305f06aca8e3756abcd3827cc7d3909b427364719
                                          • Instruction Fuzzy Hash: F481D3B56093019FD750EF29C08461BBBE1BF88358F508A2EF4D8973A1E778D985CB46
                                          Function 00401E60 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 165COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 131 401e60-401e6f 132 402020-402039 call 4046b0 131->132 133 401e75-401eb0 call 408550 131->133 132->133 139 40203f-402044 132->139 138 401eb6-401ece call 40ef60 133->138 133->139 143 401ed4-401ef7 fread 138->143 144 40208f-4020a3 call 403030 138->144 141 402014-40201d 139->141 146 402061-40207a call 403030 143->146 147 401efd-401f67 call 40ef60 malloc 143->147 144->139 146->141 153 4020a5-4020bc call 403030 147->153 154 401f6d-401f89 fread 147->154 153->141 156 402046-40205f call 403030 154->156 157 401f8f-401fa6 ferror 154->157 156->141 158 40207c-40208d call 402ed0 157->158 159 401fac-401fb2 157->159 158->141 163 401fb8-401fba 159->163 165 402000-402004 163->165 166 401fbc-401fdf 163->166 165->141 169 402006-40200e fclose 165->169 166->163 168 401fe1-401ff4 call 402ed0 166->168 168->166 172 401ff6-401ffd 168->172 169->141 172->165
                                          APIs
                                            • Part of subcall function 00408550: malloc.MSVCRT ref: 00408562
                                            • Part of subcall function 00408550: fread.MSVCRT ref: 00408656
                                            • Part of subcall function 00408550: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401EAA), ref: 004086BF
                                          • fread.MSVCRT ref: 00401EF0
                                          • malloc.MSVCRT ref: 00401F5D
                                          • fread.MSVCRT ref: 00401F82
                                          • ferror.MSVCRT ref: 00401F9D
                                          • fclose.MSVCRT ref: 00402009
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fread$malloc$fcloseferrorfree
                                          • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$X$fread$fseek$malloc
                                          • API String ID: 938791849-202209224
                                          • Opcode ID: 184307eea2abe11cbc5b19158909a6000e688a56696f3d40b4622786db81104a
                                          • Instruction ID: 48232b83441798ba76066763261cf49e77d2abc7de2ba2fc6216de52d01d1662
                                          • Opcode Fuzzy Hash: 184307eea2abe11cbc5b19158909a6000e688a56696f3d40b4622786db81104a
                                          • Instruction Fuzzy Hash: 40616EB0905301CFCB04DF25C58865ABBE1BF88314F15C96EE9989B3D6D778D884CB9A
                                          Function 0040E900 Relevance: 27.3, APIs: 18, Instructions: 269COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 173 40e900-40e921 setlocale 174 40e923-40e92b _strdup 173->174 175 40e92d-40e946 setlocale 173->175 174->175 176 40e950-40e9b1 wcstombs realloc wcstombs setlocale free 175->176 177 40e948-40e94e 175->177 179 40e9b7-40e9c0 176->179 177->176 178 40e9c8-40ea1f mbstowcs call 40e630 mbstowcs 177->178 182 40ea60-40ea64 178->182 183 40ea21-40ea32 178->183 186 40ea67-40ea6c 182->186 184 40ec40-40ec44 183->184 185 40ea38-40ea3c 183->185 184->186 187 40ec4a-40ec4f 184->187 185->184 188 40ea42-40ea46 185->188 189 40ea80-40ea89 186->189 190 40ea6e-40ea71 186->190 187->186 191 40ec55-40ec70 setlocale free 187->191 188->186 192 40ea48-40ea56 188->192 193 40eaa4-40eaa8 189->193 190->176 194 40eb66-40eb69 191->194 192->186 195 40ea90-40ea96 193->195 196 40eaaa-40eab1 193->196 194->179 197 40ea98-40eaa2 195->197 198 40eabb-40eac2 195->198 199 40eab3-40eab7 196->199 200 40eac4-40eac8 196->200 197->193 203 40ead8-40eadb 197->203 198->200 201 40eab8 198->201 199->201 200->201 202 40eaca-40eacf 200->202 201->198 202->203 204 40ead1-40ead3 202->204 205 40eb70-40eb78 203->205 206 40eae1-40eae9 203->206 204->197 209 40eccb 205->209 210 40eb7e-40eb85 205->210 207 40eaeb-40eaef 206->207 208 40eafc-40eb49 wcstombs realloc wcstombs 206->208 207->208 211 40eaf1-40eaf9 207->211 212 40eb4e-40eb61 setlocale free 208->212 213 40ecd1-40ecd9 209->213 214 40eb8d-40eb9c 209->214 210->205 215 40eb87-40eb8b 210->215 211->208 212->194 216 40ece5-40eced 213->216 217 40ecdb-40ecdf 213->217 218 40ebb0-40ebbb 214->218 219 40eb9e-40eba2 214->219 215->205 215->214 216->214 221 40ecf3-40ecfb 216->221 217->214 217->216 218->218 220 40ebbd-40ebc1 218->220 222 40ec75-40ec79 219->222 223 40eba8-40ebaf 219->223 220->218 224 40ebc3-40ebca 220->224 221->214 227 40ed01-40ed08 221->227 225 40ebd0 222->225 226 40ec7f-40ec82 222->226 223->218 224->222 224->225 228 40ebd2-40ebd5 225->228 226->228 227->214 229 40ec9b-40ecbc wcstombs 228->229 230 40ebdb-40ebe0 228->230 229->212 232 40ecc2-40ecc6 229->232 231 40ec06-40ec11 230->231 233 40ec13 231->233 234 40ebe8-40ebf3 231->234 232->212 237 40ec16-40ec1a 233->237 235 40ec90-40ec92 234->235 236 40ebf9-40ebfb 234->236 235->237 238 40ebfd-40ec00 236->238 239 40ec28-40ec33 237->239 240 40ec1c-40ec22 237->240 238->231 241 40ec98 238->241 239->239 243 40ec35-40ec39 239->243 240->238 242 40ec24 240->242 241->229 242->239 243->239 244 40ec3b 243->244 244->238
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: setlocale$wcstombs$_strdupfreerealloc
                                          • String ID:
                                          • API String ID: 2293806352-0
                                          • Opcode ID: 24aa9c2407c2a4c3f4ed46904f0d809acaa0fb0afecc03c31603bba52fa15124
                                          • Instruction ID: 614429c9ea5f0c0fbdd7ec2be82af17343d93239b7468d5b99009060838935dd
                                          • Opcode Fuzzy Hash: 24aa9c2407c2a4c3f4ed46904f0d809acaa0fb0afecc03c31603bba52fa15124
                                          • Instruction Fuzzy Hash: 48A161709042158ADB24AF66C0452BBF7F1FF44344F45883FE489A7391E33D9892DB8A
                                          Function 00408D40 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 108COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • GetCurrentProcess.KERNEL32(?,?,?,?,?,00000005,?,?,00000000,00407A00), ref: 00408D68
                                          • OpenProcessToken.ADVAPI32(?,?,?,?,?,00000005,?,?,00000000,00407A00), ref: 00408D81
                                          • free.MSVCRT ref: 00408D9F
                                          • FindCloseChangeNotification.KERNELBASE ref: 00408DB0
                                          • _snwprintf.MSVCRT ref: 00408DDE
                                          • LocalFree.KERNEL32 ref: 00408DE7
                                          • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00408E1B
                                          • CreateDirectoryW.KERNELBASE ref: 00408E3A
                                          • GetTokenInformation.KERNELBASE ref: 00408E89
                                          • GetLastError.KERNEL32 ref: 00408E92
                                          • calloc.MSVCRT ref: 00408EB0
                                          • GetTokenInformation.KERNELBASE ref: 00408EDA
                                          • ConvertSidToStringSidW.ADVAPI32 ref: 00408EF4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Token$ConvertDescriptorInformationProcessSecurityString$ChangeCloseCreateCurrentDirectoryErrorFindFreeLastLocalNotificationOpen_snwprintfcallocfree
                                          • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                          • API String ID: 2844154730-2855260032
                                          • Opcode ID: 20fa4f3d988aa03e25c24d4b52e570da4e7e5180fc1b205961bb6a5cec14814b
                                          • Instruction ID: 945ac7356c52e091193055c5d6ee7abddb38f98d0a82e690350cb517e8796f62
                                          • Opcode Fuzzy Hash: 20fa4f3d988aa03e25c24d4b52e570da4e7e5180fc1b205961bb6a5cec14814b
                                          • Instruction Fuzzy Hash: 2E41C4B05083009FE700AF69D68825EBBE4BF84755F418E2EF8D9A7291D778D548CF86
                                          Function 00408190 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 107processsynchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • SetConsoleCtrlHandler.KERNEL32(00000000,?,00000000,?,00404169), ref: 004081DB
                                          • GetStartupInfoW.KERNEL32 ref: 00408203
                                          • _fileno.MSVCRT ref: 0040824E
                                          • _get_osfhandle.MSVCRT ref: 0040825C
                                          • _fileno.MSVCRT ref: 00408277
                                          • _get_osfhandle.MSVCRT ref: 0040827F
                                          • _fileno.MSVCRT ref: 0040829A
                                          • _get_osfhandle.MSVCRT ref: 004082A2
                                          • GetCommandLineW.KERNEL32 ref: 004082B1
                                          • CreateProcessW.KERNELBASE ref: 00408301
                                          • WaitForSingleObject.KERNEL32 ref: 0040831D
                                          • GetExitCodeProcess.KERNEL32 ref: 00408335
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _fileno_get_osfhandle$Process$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                          • String ID: CreateProcessW$Error creating child process!
                                          • API String ID: 1833775142-3524285272
                                          • Opcode ID: 32d5236159ff9933d5b80ff1d926fdea5f1ce6c1af8ead61a65d3641c3c49501
                                          • Instruction ID: e1b98e6d24d483291a0d25806d4a7f2563c0c3411ac3d46acccf3020f7941406
                                          • Opcode Fuzzy Hash: 32d5236159ff9933d5b80ff1d926fdea5f1ce6c1af8ead61a65d3641c3c49501
                                          • Instruction Fuzzy Hash: E14195B05083448FD710AF69D58935EBBF0BF84314F418E2EE8D887291D7B99488CF96
                                          Function 00408E58 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 86COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • free.MSVCRT ref: 00408D9F
                                          • FindCloseChangeNotification.KERNELBASE ref: 00408DB0
                                          • _snwprintf.MSVCRT ref: 00408DDE
                                          • LocalFree.KERNEL32 ref: 00408DE7
                                          • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00408E1B
                                          • CreateDirectoryW.KERNELBASE ref: 00408E3A
                                          • GetTokenInformation.KERNELBASE ref: 00408E89
                                          • GetLastError.KERNEL32 ref: 00408E92
                                          • calloc.MSVCRT ref: 00408EB0
                                          • GetTokenInformation.KERNELBASE ref: 00408EDA
                                          • ConvertSidToStringSidW.ADVAPI32 ref: 00408EF4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ConvertDescriptorInformationSecurityStringToken$ChangeCloseCreateDirectoryErrorFindFreeLastLocalNotification_snwprintfcallocfree
                                          • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                          • API String ID: 897783455-2855260032
                                          • Opcode ID: cbc9b7a7022e2090bf5412f5cba968d65ad33e5ede0d00afb860ea90c6cf80a8
                                          • Instruction ID: 5ee2362bb1dffc1b92a9066ae5264b9d3527a87a2536074db898feb824fd9f33
                                          • Opcode Fuzzy Hash: cbc9b7a7022e2090bf5412f5cba968d65ad33e5ede0d00afb860ea90c6cf80a8
                                          • Instruction Fuzzy Hash: 8C31D3B05083009FE700AF69D68835EBBE0FF84715F01892EE8D9972A1D778D988CF46
                                          Function 00407DD0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 122stringCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 285 407dd0-407e0c call 40e630 call 4074f0 290 407e12-407e41 call 4074f0 285->290 291 407f05-407f11 285->291 290->291 294 407e47-407e65 strlen strtok 290->294 295 407f18-407f46 call 408b00 _wstat 294->295 296 407e6b-407e72 294->296 301 407f67-407f81 call 4046b0 295->301 302 407f48-407f51 295->302 298 407e78-407e8a strlen 296->298 298->291 300 407e8c-407ec0 strlen strcpy strtok 298->300 300->295 303 407ec2-407ee9 call 408b00 _wstat 300->303 304 407f82-407f90 call 407650 302->304 305 407f53-407f55 302->305 303->298 315 407eeb-407ef3 call 408d40 303->315 318 407f92-407f98 304->318 319 407fb5-407fbf 304->319 308 407ef5-407f00 call 402f30 305->308 309 407f57-407f62 call 402f30 305->309 308->291 309->301 315->298 320 407f9a 318->320 321 407f9e-407fb3 free 318->321 319->309 320->321 321->305
                                          APIs
                                          Strings
                                          • ERROR: file already exists but should not: %s, xrefs: 00407EF9
                                          • WARNING: file already exists but should not: %s, xrefs: 00407F5B
                                          • PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00407F82
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlen$_wstatstrtok$ByteCharMultiWidefreestrcpy
                                          • String ID: ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s
                                          • API String ID: 439695417-1996835591
                                          • Opcode ID: ae956383a1602fbf16243ccfb6895fa433991ee32204bf530d7f01d15dce0662
                                          • Instruction ID: 0d1752cbd12df257bbbd412badab65e831f2b54a7211b67fa555c1920da682f5
                                          • Opcode Fuzzy Hash: ae956383a1602fbf16243ccfb6895fa433991ee32204bf530d7f01d15dce0662
                                          • Instruction Fuzzy Hash: DE411CB050D7019AD310AF25D58429EBBE4EF84748F42883EE5C897391DB7CA4849B9B
                                          Function 0040EF90 Relevance: 9.1, APIs: 6, Instructions: 54COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 381 40ef90-40efaa 382 40efd8-40efea fgetpos 381->382 383 40efac-40efaf 381->383 384 40f03c-40f041 382->384 385 40efec-40eff4 382->385 386 40f000-40f028 fflush _fileno _filelengthi64 383->386 387 40efb1-40efb3 383->387 389 40efcd-40efd4 384->389 385->386 388 40efc1-40efc8 fsetpos 385->388 386->388 390 40efb5-40efbd 387->390 391 40f02a-40f03a _errno 387->391 388->389 390->388 391->389
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _errno_filelengthi64_filenofflushfgetposfsetpos
                                          • String ID:
                                          • API String ID: 4183758535-0
                                          • Opcode ID: 0e874d7c1527097df73717f8d8dd802be641f195fc25bc8155d28149c3b9a275
                                          • Instruction ID: 4b13233adec89eef7c79cf0ca00fcee1fa5ec0274880c3d786e8fbaf61c832b7
                                          • Opcode Fuzzy Hash: 0e874d7c1527097df73717f8d8dd802be641f195fc25bc8155d28149c3b9a275
                                          • Instruction Fuzzy Hash: 7A113DB15087059BC310AF2A958105FBBE4EF91354F120D3FF89493292E239D999CB96
                                          Function 00401DBB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 392 401dbb-401de1 free call 403030 398 401d5c-401d63 fclose 392->398 399 401d4d-401d55 fclose 392->399 400 401d68-401d71 398->400 399->398
                                          APIs
                                            • Part of subcall function 00403030: _errno.MSVCRT ref: 00403064
                                            • Part of subcall function 00403030: strerror.MSVCRT ref: 0040306F
                                          • free.MSVCRT ref: 00401D25
                                          • fclose.MSVCRT ref: 00401D50
                                          • fclose.MSVCRT ref: 00401D63
                                          Strings
                                          • fwrite, xrefs: 00401DD1
                                          • Failed to extract %s: failed to write data chunk!, xrefs: 00401DC4
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclose$_errnofreestrerror
                                          • String ID: Failed to extract %s: failed to write data chunk!$fwrite
                                          • API String ID: 3523629215-1560601992
                                          • Opcode ID: 9353a7da99b3be11b46e5f84fdf26ac4210b160aba239bd7510e2b4b1990afc0
                                          • Instruction ID: aff44569ab8606813c7f29ae03d31c1d370def72fb3cd313521a05d94b0daf67
                                          • Opcode Fuzzy Hash: 9353a7da99b3be11b46e5f84fdf26ac4210b160aba239bd7510e2b4b1990afc0
                                          • Instruction Fuzzy Hash: 43F012B56093408BC700AF75E48519DB7E0BF80314F12892FF4999B291D338D485CB4A
                                          Function 00401DE6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 401 401de6-401e11 call 403030 406 401d5c-401d63 fclose 401->406 407 401d4d-401d55 fclose 401->407 408 401d68-401d71 406->408 407->406
                                          APIs
                                            • Part of subcall function 00403030: _errno.MSVCRT ref: 00403064
                                            • Part of subcall function 00403030: strerror.MSVCRT ref: 0040306F
                                          • fclose.MSVCRT ref: 00401D50
                                          • fclose.MSVCRT ref: 00401D63
                                          Strings
                                          • fseek, xrefs: 00401E01
                                          • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401DF4
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclose$_errnostrerror
                                          • String ID: Failed to extract %s: failed to seek to the entry's data!$fseek
                                          • API String ID: 531001455-144044986
                                          • Opcode ID: 05b533b50c2bc4eff8379d834af169491f677ebbb3d68f1e93d9e12fa35dd1bd
                                          • Instruction ID: b1b358e5bfedda9d4d999058601c1f88ca93a78291f5d028d604a8f107234477
                                          • Opcode Fuzzy Hash: 05b533b50c2bc4eff8379d834af169491f677ebbb3d68f1e93d9e12fa35dd1bd
                                          • Instruction Fuzzy Hash: D2F06C756053419BCB00AF39D844299B7F1FF80318F05892FF89997390D338E985CB49
                                          Function 00408550 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 409 408550-40856b malloc 410 408571-40858f call 40ef60 409->410 411 4086b8-4086ba 409->411 410->411 415 408595-4085b8 call 40f050 410->415 413 4086bc-4086cf free 411->413 415->411 418 4085be-4085d2 415->418 419 4085d6-4085ec 418->419 420 4085fe-40861d 419->420 421 4085ee-4085f6 419->421 422 4086b2-4086b4 420->422 423 408623-40863d call 40ef60 420->423 421->420 422->411 423->422 426 40863f-40865d fread 423->426 426->422 427 40865f-408666 426->427 428 408690-408692 427->428 429 408670-40868c memcmp 428->429 430 408694-4086ac 428->430 431 4086d0-4086e6 429->431 432 40868e 429->432 430->419 430->422 431->413 432->428
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: freadfreemalloc
                                          • String ID:
                                          • API String ID: 2848089211-0
                                          • Opcode ID: 1a9925d51e5002b52557f3f82c440e3fe1630ff818de9e7bab4658c492a1da82
                                          • Instruction ID: cab96f3465d474487508a1ec879676b61213e1df38a8e45f68965f676f42926a
                                          • Opcode Fuzzy Hash: 1a9925d51e5002b52557f3f82c440e3fe1630ff818de9e7bab4658c492a1da82
                                          • Instruction Fuzzy Hash: 78413B716083118BC710DF29C58060FFBE1AFC8354F168E2EF9D897391EA79D8498B86
                                          Function 0040EFF6 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 433 40eff6-40effd 434 40f000-40f028 fsetpos fflush _fileno _filelengthi64 433->434 436 40efcd-40efd4 434->436
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _filelengthi64_filenofflushfsetpos
                                          • String ID:
                                          • API String ID: 1406207278-0
                                          • Opcode ID: 1ed6eb79ae09dcc32bdfa7ab410ec694ef2291df6c0a71ee54ab17ab7ac6ca82
                                          • Instruction ID: 1330b5d8d42a305a2191b976321c9ddfa34460ad39984d8d2968ac2a071300d9
                                          • Opcode Fuzzy Hash: 1ed6eb79ae09dcc32bdfa7ab410ec694ef2291df6c0a71ee54ab17ab7ac6ca82
                                          • Instruction Fuzzy Hash: 5BE0EDB2908B158BC700BF66A88119DFBE0FF80358F134C2FE4D953212E638A5D58B86
                                          Function 00401D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Failed to extract %s: failed to open archive file!, xrefs: 00401DA4
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclose$_wfopenfreemalloc
                                          • String ID: Failed to extract %s: failed to open archive file!
                                          • API String ID: 409134274-2950503014
                                          • Opcode ID: bc8c0f40a64667b258747b891fccd1e7d42742d54face0fde24ed5700ed4ad79
                                          • Instruction ID: 7614606d81e887eecfecfed5343dc5ca5952679920abc2288eb417914ad53e33
                                          • Opcode Fuzzy Hash: bc8c0f40a64667b258747b891fccd1e7d42742d54face0fde24ed5700ed4ad79
                                          • Instruction Fuzzy Hash: 93F01DB5A043059BDB00AF35E84419AB7E1BF80318F01893EE898DB391E738D8858B86
                                          Function 0040A090 Relevance: 5.1, APIs: 4, Instructions: 102COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: mallocmemcpy
                                          • String ID:
                                          • API String ID: 4276657696-0
                                          • Opcode ID: 02d46d53eafb68b30b763f551fb2a3305e08925e6983bdf89da9902f672765db
                                          • Instruction ID: 797d5049136f8a5f83aef3165c4761c57e8610ee519af45eb6e184e31c624f88
                                          • Opcode Fuzzy Hash: 02d46d53eafb68b30b763f551fb2a3305e08925e6983bdf89da9902f672765db
                                          • Instruction Fuzzy Hash: 23311371605B008FC354DF3AD68065BFBE2FB88354F41993ED48A87B50E675F8858B41
                                          Function 004017F4 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 26fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Failed to extract %s: decompression resulted in return code %d!, xrefs: 00401813
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$ferrorfwrite
                                          • String ID: Failed to extract %s: decompression resulted in return code %d!
                                          • API String ID: 2451956730-2259475180
                                          • Opcode ID: 830b903f36b84025c492a9392f2ebfc8541cf9aaa14fb670190ebe148b401e78
                                          • Instruction ID: 3822a968a1abd095370c554b2ca83eb16347efd21d9f73064333f8d65a1dff39
                                          • Opcode Fuzzy Hash: 830b903f36b84025c492a9392f2ebfc8541cf9aaa14fb670190ebe148b401e78
                                          • Instruction Fuzzy Hash: 5AF01CB56097008BC710BF29E48105EBBE1FF81324F528A2EF5E897381D739D8818B86
                                          Function 00401124 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: __wgetmainargs
                                          • String ID: B
                                          • API String ID: 1709950718-3394935788
                                          • Opcode ID: 41afb40690170ecdc9a50beea52290fec0f59d8749ba09f0fc9408188c674ce4
                                          • Instruction ID: 27c32f95ce735926b30c16c90320b224d17bcd53438576fbaefc61be872f07d1
                                          • Opcode Fuzzy Hash: 41afb40690170ecdc9a50beea52290fec0f59d8749ba09f0fc9408188c674ce4
                                          • Instruction Fuzzy Hash: 81E092B1A04711EFC714DF25E645246BBE0BB48308F81D91EE69897210D3B9A549DF8A
                                          Function 0040A3F0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc
                                          • String ID: 8
                                          • API String ID: 2803490479-4194326291
                                          • Opcode ID: 88865b5b26300d2bd4c71fb6e3d37b9dfb2c71bd695db075464367e8e3ddd3a1
                                          • Instruction ID: 3d9a3cba30c8a6cce76611aecb6f7ccedd9577938697bd5609853f48fc3db6fb
                                          • Opcode Fuzzy Hash: 88865b5b26300d2bd4c71fb6e3d37b9dfb2c71bd695db075464367e8e3ddd3a1
                                          • Instruction Fuzzy Hash: 542159B45083018FDB10DF29C5886267BE0AF48314F51866EA8499B3C5E3B8CC65CF47
                                          Function 00401D2C Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00401610: malloc.MSVCRT ref: 00401679
                                            • Part of subcall function 00401610: malloc.MSVCRT ref: 0040168F
                                            • Part of subcall function 00401610: fread.MSVCRT ref: 004016F0
                                            • Part of subcall function 00401610: ferror.MSVCRT ref: 00401706
                                            • Part of subcall function 00401610: fwrite.MSVCRT ref: 0040178B
                                            • Part of subcall function 00401610: ferror.MSVCRT ref: 004017A3
                                          • fclose.MSVCRT ref: 00401D50
                                          • fclose.MSVCRT ref: 00401D63
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fcloseferrormalloc$freadfwrite
                                          • String ID:
                                          • API String ID: 2659978838-0
                                          • Opcode ID: ba584c84dcc7021ed2e9611c05d47d0ae0c51191637eb14f3cb18bd1de7ff9c6
                                          • Instruction ID: 2086b21a0a2fd9d0ee52b7dbb019afd7e35cf4cc68d36bcb5f0e3d1ef994c319
                                          • Opcode Fuzzy Hash: ba584c84dcc7021ed2e9611c05d47d0ae0c51191637eb14f3cb18bd1de7ff9c6
                                          • Instruction Fuzzy Hash: ADE01A75B043008BCB00AF29E84035AB7E1AF84354F06482EF888CB351D739D884CB95
                                          Function 004018B6 Relevance: 2.5, APIs: 2, Instructions: 19COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID:
                                          • API String ID: 1294909896-0
                                          • Opcode ID: ef69f32362a42e0ce2ffe8284a07d848220a277b661e213d5c3d7f37b51e11aa
                                          • Instruction ID: 37d18b623566974bb2935c6215979c875cfe96a297bc96d00919041d074b5ac9
                                          • Opcode Fuzzy Hash: ef69f32362a42e0ce2ffe8284a07d848220a277b661e213d5c3d7f37b51e11aa
                                          • Instruction Fuzzy Hash: 80E0E6B6604715CBCB107F65F48119DF7E0FF41328F124A3FE9E493291D639A5454B86
                                          Function 004046B0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • _wfopen.MSVCRT ref: 00404703
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide_wfopen
                                          • String ID:
                                          • API String ID: 372205238-0
                                          • Opcode ID: 13c07e3d3bc0b19f75017dbdb54b07b75c5c7dcab1f4d19b5ddeb740e7124e77
                                          • Instruction ID: 3468f0b4211825adde8639be08c033172f5b0e4316271c3a96c81e3ef559f4c6
                                          • Opcode Fuzzy Hash: 13c07e3d3bc0b19f75017dbdb54b07b75c5c7dcab1f4d19b5ddeb740e7124e77
                                          • Instruction Fuzzy Hash: 2FF0F2B04193009FC314FF28D58868EBBE8FF88348F018C2EF5C897252D6789549CB92
                                          Function 0040A4B1 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc
                                          • String ID:
                                          • API String ID: 2803490479-0
                                          • Opcode ID: e2173ce04817a78d231aa9074b1aa79180b14f8ea2ab174e27efc7c36e8625ac
                                          • Instruction ID: 34294cd6affbb3e785c4932bfc48d0f633533baf833ca0b38d678e79e0ec05fd
                                          • Opcode Fuzzy Hash: e2173ce04817a78d231aa9074b1aa79180b14f8ea2ab174e27efc7c36e8625ac
                                          • Instruction Fuzzy Hash: 87011EB45053018FDB54DF19C184356BBE0FF88304F55896EE8889B385D3B8C855CF46

                                          Non-executed Functions

                                          Function 00406D50 Relevance: 164.9, APIs: 31, Strings: 63, Instructions: 385libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: AddressProc
                                          • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                          • API String ID: 190572456-2208601799
                                          • Opcode ID: 48fc8fb41c16fe699d029926af7cab486289aba105d4ff2453387a530e0e4b39
                                          • Instruction ID: b9744897239d32f33dc6bfef900ed9271cf1591fb07702e628d33a7ecb5ec9b2
                                          • Opcode Fuzzy Hash: 48fc8fb41c16fe699d029926af7cab486289aba105d4ff2453387a530e0e4b39
                                          • Instruction Fuzzy Hash: C3F108B090A701CBC7106F759A4506EBAF0AE41758F40CA3FB4A49B2C1DB7C9499DB9F
                                          Function 004086F0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FormatMessageW.KERNEL32(?,?,?,?,00402FD9), ref: 0040873F
                                          • WideCharToMultiByte.KERNEL32 ref: 00408787
                                          • GetLastError.KERNEL32(?,00402FD9), ref: 004087D0
                                          Strings
                                          • WideCharToMultiByte, xrefs: 004087E8
                                          • PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 004087FA
                                          • FormatMessageW, xrefs: 004087B0
                                          • PyInstaller: FormatMessageW failed., xrefs: 004087C2
                                          • Failed to encode wchar_t as UTF-8., xrefs: 004087E0
                                          • No error messages generated., xrefs: 004087A8
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharErrorFormatLastMessageMultiWide
                                          • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                          • API String ID: 1653872744-2573406579
                                          • Opcode ID: f18fbf8d48d34d915993c9fedb6177582b1632770400b321313a73d9a670d996
                                          • Instruction ID: e5d7e6b934a0c345d3486c1070e2a035779d45014a63eb974780677ace9c2cb0
                                          • Opcode Fuzzy Hash: f18fbf8d48d34d915993c9fedb6177582b1632770400b321313a73d9a670d996
                                          • Instruction Fuzzy Hash: 8B111AB45093018BE310AF69D54835BBAF0EB94389F50892EE4D49A285D7BD858C8BA7
                                          Function 004014F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 43libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: AddressProc$HandleLibraryLoadModule
                                          • String ID: , B$__deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
                                          • API String ID: 384173800-2541462354
                                          • Opcode ID: a376881f7d4377a9ad5e0e3f6ac5215553b1e171285a39ee36456c721ec719f3
                                          • Instruction ID: 6c6c026f4a83c0f72c7764c329cd2c4586c53e905c616f5fc2452e48b3062107
                                          • Opcode Fuzzy Hash: a376881f7d4377a9ad5e0e3f6ac5215553b1e171285a39ee36456c721ec719f3
                                          • Instruction Fuzzy Hash: 200175B1805304ABD700BF79AD4425ABFF4EB44399F02853FE98957260D7789848CB9F
                                          Function 00414570 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 1456COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: $ $9$Infinity$NaN
                                          • API String ID: 0-2156819404
                                          • Opcode ID: fb752ad01a167b7c3ce2d06964dcb0e38cd8f53d46aad30b3ca282ca9372ef33
                                          • Instruction ID: 135e34cb9ca9e985b4a278f7eb7425a40accb92fd251a454e4488a178f868c55
                                          • Opcode Fuzzy Hash: fb752ad01a167b7c3ce2d06964dcb0e38cd8f53d46aad30b3ca282ca9372ef33
                                          • Instruction Fuzzy Hash: 93D224B1A08781CFD720DF29C08479ABBE1BBC8354F15891EE89587351E779D885CF8A
                                          Function 004011B3 Relevance: 9.1, APIs: 6, Instructions: 119sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc$ExceptionFilterSleepUnhandled__p__wcmdln_amsg_exit_inittermmemcpy
                                          • String ID:
                                          • API String ID: 527270645-0
                                          • Opcode ID: 0fc769238dbcbaccc1defde77868a2231646de065e682eb93854c2df569345b0
                                          • Instruction ID: 9529fa1fa00849a3a4482e99920bc3e8817caf8231a65d9ae2bb721758bc0f10
                                          • Opcode Fuzzy Hash: 0fc769238dbcbaccc1defde77868a2231646de065e682eb93854c2df569345b0
                                          • Instruction Fuzzy Hash: 45414DB4A043018FDB20EFA9D98475AB7F0FB44344F51453EE985A73B0DBB89845CB89
                                          Function 004131C0 Relevance: 7.9, Strings: 6, Instructions: 424COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .$@$Inf$NaN$gfff$gfff
                                          • API String ID: 0-3155045678
                                          • Opcode ID: 649fb20abb9812e0e09aa82762c5c86987e6c960a3fbba0dce5609d8b374321b
                                          • Instruction ID: a46ccd9e596887ef7586e3f83d06ea90e66d5ef1390d3a99a1c477af4a84c032
                                          • Opcode Fuzzy Hash: 649fb20abb9812e0e09aa82762c5c86987e6c960a3fbba0dce5609d8b374321b
                                          • Instruction Fuzzy Hash: F3F1E5717083018BD7149F29C48429BB7E1BF84345F188A6FE899DB355D738DE85CB4A
                                          Function 00410A20 Relevance: 7.9, Strings: 6, Instructions: 424COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .$@$Inf$NaN$gfff$gfff
                                          • API String ID: 0-3155045678
                                          • Opcode ID: dab502d568537ec720aaf45a7e0f9e0a341b1c2f8383f2d09a6fbb2e9003e841
                                          • Instruction ID: d384fdde2e77d5b6e892d09c38fe2caee72570f537571c461ee27f5ac1cb1202
                                          • Opcode Fuzzy Hash: dab502d568537ec720aaf45a7e0f9e0a341b1c2f8383f2d09a6fbb2e9003e841
                                          • Instruction Fuzzy Hash: 2EF1C7716083018BD7149E69C48469BB7D1BFC8314F148A2FF999DB345E7B8ECC58B8A
                                          Function 00401170 Relevance: 7.6, APIs: 5, Instructions: 135sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__wcmdlnmemcpy
                                          • String ID:
                                          • API String ID: 1204267290-0
                                          • Opcode ID: b6dbdc372fc45292959b8ad62cb9b1d82b3ea37c5ee8f48f33ec792cbd8abaac
                                          • Instruction ID: 683df0bb935b0ba919073670d03ce8182cb7faa8ee4b460d1895c998537b4a50
                                          • Opcode Fuzzy Hash: b6dbdc372fc45292959b8ad62cb9b1d82b3ea37c5ee8f48f33ec792cbd8abaac
                                          • Instruction Fuzzy Hash: 0C5180B0A043019FDB20DFA8D984B5AB7F0FB44344F11453EE945AB3B1D7789845CB89
                                          Function 0040A670 Relevance: 7.0, Strings: 5, Instructions: 723COMMON
                                          Download Yara Rule
                                          Strings
                                          • invalid block type, xrefs: 0040C008
                                          • invalid stored block lengths, xrefs: 0040AA6D
                                          • incorrect data check, xrefs: 0040A858
                                          • too many length or distance symbols, xrefs: 0040B5DB
                                          • invalid literal/length code, xrefs: 0040C139
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: incorrect data check$invalid block type$invalid literal/length code$invalid stored block lengths$too many length or distance symbols
                                          • API String ID: 0-817236767
                                          • Opcode ID: 732da43ed72cc2c4120bf8a60150f6b0ba1b7153d6323c3b09595d69c6cd98af
                                          • Instruction ID: b6d793466c67ffd8e3b1f57c4bb4f26a608bbcae03501d0a96c59416067c7ba4
                                          • Opcode Fuzzy Hash: 732da43ed72cc2c4120bf8a60150f6b0ba1b7153d6323c3b09595d69c6cd98af
                                          • Instruction Fuzzy Hash: 0C623B719183418FC754CF28C18462ABBF1FF88314F598A6EE999A7391D378E941CF86
                                          Function 0040AF90 Relevance: 6.8, Strings: 5, Instructions: 508COMMON
                                          Download Yara Rule
                                          Strings
                                          • invalid code -- missing end-of-block, xrefs: 0040BB65
                                          • invalid literal/lengths set, xrefs: 0040C5EE
                                          • incorrect data check, xrefs: 0040A858
                                          • invalid distances set, xrefs: 0040C77C
                                          • invalid bit length repeat, xrefs: 0040C659
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: incorrect data check$invalid bit length repeat$invalid code -- missing end-of-block$invalid distances set$invalid literal/lengths set
                                          • API String ID: 0-3719072575
                                          • Opcode ID: 87f7b0a5de183da02882c39e40a9c5277c9a1d09e12685698913540847143514
                                          • Instruction ID: 1cbbd36348c41b3311386e0b9d0a20f1b1c4d21bf7d9573915b1ba99331fb76a
                                          • Opcode Fuzzy Hash: 87f7b0a5de183da02882c39e40a9c5277c9a1d09e12685698913540847143514
                                          • Instruction Fuzzy Hash: C7221775A083418FC714CF18C48062ABBF1FF88714F198A2EE999A7391D775E941CF8A
                                          Function 00408F20 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Find$CloseFileFirst
                                          • String ID:
                                          • API String ID: 2295610775-0
                                          • Opcode ID: d88965ee97bb4822c6f5735e6fb7c0daf0eae884ec34d0cf24b004702f191101
                                          • Instruction ID: 704cf8f4e32a680898036105631b38574d231553fb3af9f17300ce401ba249f6
                                          • Opcode Fuzzy Hash: d88965ee97bb4822c6f5735e6fb7c0daf0eae884ec34d0cf24b004702f191101
                                          • Instruction Fuzzy Hash: 6CF0DA745183418BE710EFB4D54C31EBBE0BB84318F544E2DE8A9922E0E7BD8558CB87
                                          Function 004095E6 Relevance: .3, Instructions: 282COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ad0a953a7912c998d8460aa3cbf0d34e957a404584fcef4e55bd5703657de69d
                                          • Instruction ID: 0c18a3eff60174cb18f533cfcdf03bd16056950eb2d79401b90b41b69f56c1f0
                                          • Opcode Fuzzy Hash: ad0a953a7912c998d8460aa3cbf0d34e957a404584fcef4e55bd5703657de69d
                                          • Instruction Fuzzy Hash: 93B1B231A142648FC708EF2ED89416AB7F1EBC9311F068A7EE685D3391D335E906CB58
                                          Function 00409949 Relevance: .2, Instructions: 156COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c935b049c362aa1a63225b768a6dbc6fca87cb99015741649604f348b5fa66f8
                                          • Instruction ID: 2bdbe780b9e1ae2383d83eb5e7904df0d3d9205a4af587aec09da948086b2981
                                          • Opcode Fuzzy Hash: c935b049c362aa1a63225b768a6dbc6fca87cb99015741649604f348b5fa66f8
                                          • Instruction Fuzzy Hash: EC51C3717241604BCB08EE3EDCA4176B7E2E7C6302B5586BEE682C3795C739D902C758
                                          Function 004025E0 Relevance: 47.5, APIs: 20, Strings: 7, Instructions: 234windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: MessageSend$Create$Window$BaseClientDialogFontIconIndirectInfoLoadMetricParametersRectSystemUnits
                                          • String ID: $0$BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                          • API String ID: 3223904152-2569830377
                                          • Opcode ID: 7943c390b9244dced28919df85ac531d04cee13212c8fd2bffe6eea2c2ad8852
                                          • Instruction ID: 2067da98e2504e100063f8f35cc28d01e2b4b69eff652bc710e7bd6244d7957c
                                          • Opcode Fuzzy Hash: 7943c390b9244dced28919df85ac531d04cee13212c8fd2bffe6eea2c2ad8852
                                          • Instruction Fuzzy Hash: B7C183B4909301DFE700EF68C19835ABFE0FB88354F10896EE8988B355D7B99548CF96
                                          Function 00403880 Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 262COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID: %s%c%s.py$Absolute path to script exceeds PATH_MAX$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to unmarshal code object for %s$Traceback is disabled via bootloader option.$\$__file__$__main__$_pyi_main_co$format_exception$pyi-disable-windowed-traceback$traceback
                                          • API String ID: 1294909896-4198433784
                                          • Opcode ID: 15c4208f2d8e130932219e82c4b0b5fb2b9fa64d0c384d1944226fe3b7cf001d
                                          • Instruction ID: 6540644356b1fe9e7dd3889ac2da6173512776e99aae4954ed64b62622b12aad
                                          • Opcode Fuzzy Hash: 15c4208f2d8e130932219e82c4b0b5fb2b9fa64d0c384d1944226fe3b7cf001d
                                          • Instruction Fuzzy Hash: 35B1C4B4608701DFC710AF29D58815ABBE4BF88355F41892EE9D9D3390DBB8C981CF5A
                                          Function 00405A60 Relevance: 28.6, APIs: 2, Strings: 17, Instructions: 132COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                          • free.MSVCRT ref: 00405C26
                                          • free.MSVCRT ref: 00405C34
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$EnvironmentVariable
                                          • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$Error detected starting Python VM.$Failed to convert argv to wchar_t$Failed to convert progname to wchar_t$Failed to convert pyhome to wchar_t$Failed to convert pypath to wchar_t$Invalid value for PYTHONUTF8=%s; disabling utf-8 mode!$PYTHONUTF8$\$\$base_library.zip$lib-dynload$sys.path (based on %s) exceeds buffer[%d] space
                                          • API String ID: 471908985-4092346810
                                          • Opcode ID: d52d000c1473065b0899b1ed74f52dc053d7693a20c2f5cf1e11e3dc0598f350
                                          • Instruction ID: 22c84da25320057bd24c90e3ec615a054902b22b929e7a825a46e5f77c0d8298
                                          • Opcode Fuzzy Hash: d52d000c1473065b0899b1ed74f52dc053d7693a20c2f5cf1e11e3dc0598f350
                                          • Instruction Fuzzy Hash: B5513BB0609B009BE310AF65D54826BBBE0EF44354F458A2FE9D5A72D1C7BC8485CF9B
                                          Function 0040E660 Relevance: 25.7, APIs: 17, Instructions: 174COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: setlocale$wcstombs$_strdupfreerealloc
                                          • String ID:
                                          • API String ID: 2293806352-0
                                          • Opcode ID: 9dd92505955bcef7c0158eea0a81386eeefa2c3a7dcaf571075d4c2b4108fbf2
                                          • Instruction ID: 1138b9a49e69c7a07146da18e6cbb8f4c5af7b9e580f31b8634df38c7834fdfb
                                          • Opcode Fuzzy Hash: 9dd92505955bcef7c0158eea0a81386eeefa2c3a7dcaf571075d4c2b4108fbf2
                                          • Instruction Fuzzy Hash: 036130709082119BCB10AF66C44536FBBE1EF94344F468D3FE488A7391E77C8891DB9A
                                          Function 00402B80 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 81windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _wcsdupfree$DeleteDestroyDialogHandleIconIndirectModuleObjectParammemset
                                          • String ID: 8 $@$Unhandled exception in script
                                          • API String ID: 3963799495-1206599369
                                          • Opcode ID: 47d42c7bf4735e15dde57d63418aef27060c31eb55eeab7a34c0ce7b6333cf64
                                          • Instruction ID: 5f7a7bfca591e00baa7cae047d41d3b5615dab244da7dd9e67f68e2e3487ae70
                                          • Opcode Fuzzy Hash: 47d42c7bf4735e15dde57d63418aef27060c31eb55eeab7a34c0ce7b6333cf64
                                          • Instruction Fuzzy Hash: C231E5B05087409FD750EF69D48969FBBE4AF89348F428D2EE58897350DB78D488CB86
                                          Function 004077C0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 101COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • ExpandEnvironmentStringsW.KERNEL32(?,00000000,?,?,0040797A,?,00000000,?,?,00407B92), ref: 0040780C
                                          • free.MSVCRT ref: 0040781A
                                            • Part of subcall function 00408FA0: wcslen.MSVCRT ref: 00408FAC
                                          • _wfullpath.MSVCRT ref: 0040784A
                                          • wcschr.MSVCRT ref: 00407877
                                          • wcsncpy.MSVCRT ref: 004078A7
                                          • CreateDirectoryW.KERNEL32 ref: 004078B7
                                          • wcschr.MSVCRT ref: 004078C7
                                          • CreateDirectoryW.KERNEL32 ref: 004078DD
                                          • _wcsdup.MSVCRT ref: 004078F3
                                          Strings
                                          • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00407900
                                          • \, xrefs: 004078BF
                                          • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00407920
                                          • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 0040792E
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: CreateDirectorywcschr$ByteCharEnvironmentExpandMultiStringsWide_wcsdup_wfullpathfreewcslenwcsncpy
                                          • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.$\
                                          • API String ID: 274989731-3296995943
                                          • Opcode ID: f389d4807b938e55ecb376f0f53028c8ff9e65046959c3115b4ca1d10331afd9
                                          • Instruction ID: b23a07802ca04ce963d90eb9615f597fb6c60bb1e29e7f7f3b36ce21c54aa4ff
                                          • Opcode Fuzzy Hash: f389d4807b938e55ecb376f0f53028c8ff9e65046959c3115b4ca1d10331afd9
                                          • Instruction Fuzzy Hash: 1C315DB1A087018BD3107F69D94935FBAE4BF84344F05883EE9C897381DB79D8459B8B
                                          Function 00403370 Relevance: 22.7, APIs: 2, Strings: 13, Instructions: 220stringCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004032F0: strchr.MSVCRT ref: 0040332F
                                            • Part of subcall function 004032F0: strcpy.MSVCRT ref: 00403345
                                          • strcmp.MSVCRT ref: 0040351A
                                            • Part of subcall function 00407FD0: feof.MSVCRT ref: 00408033
                                            • Part of subcall function 00407FD0: fread.MSVCRT ref: 00408057
                                            • Part of subcall function 00407FD0: ferror.MSVCRT ref: 00408063
                                            • Part of subcall function 00407FD0: clearerr.MSVCRT ref: 00408074
                                            • Part of subcall function 00407FD0: fclose.MSVCRT ref: 004080B8
                                            • Part of subcall function 00407FD0: fclose.MSVCRT ref: 004080C0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclose$clearerrfeofferrorfreadstrchrstrcmpstrcpy
                                          • String ID: %s%c%s$%s%c%s%c%s$%s%c%s%c%s%c%s$%s%c%s.exe$%s%c%s.pkg$Archive not found: %s$Archive path exceeds PATH_MAX$Failed to copy %s$Failed to extract %s$Failed to open archive %s!$\$\$\
                                          • API String ID: 3546371548-4129990315
                                          • Opcode ID: 2745f0228d78fa06d22c06bd4220cdf573474b19550bea2584d5a11ea4fe38bb
                                          • Instruction ID: 8a7e982486c7dae7ba286fda290711f8ff69515a3f7b07f7f3724835a8bf7877
                                          • Opcode Fuzzy Hash: 2745f0228d78fa06d22c06bd4220cdf573474b19550bea2584d5a11ea4fe38bb
                                          • Instruction Fuzzy Hash: 67A126B0508701AFC710EF26C58415FBBE8BF84755F408A2EF498A7390D778DA858F8A
                                          Function 00403D60 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 316stringCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004021E0: calloc.MSVCRT ref: 004021F2
                                            • Part of subcall function 004045D0: GetModuleFileNameW.KERNEL32(00000000,00403DA0), ref: 004045F4
                                          • fclose.MSVCRT ref: 00404245
                                            • Part of subcall function 00404670: strcpy.MSVCRT(?,-00000004,?,00000002,?,00401600), ref: 00404683
                                            • Part of subcall function 00404670: strlen.MSVCRT ref: 0040468B
                                            • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                          • free.MSVCRT ref: 00403E26
                                            • Part of subcall function 00407770: SetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0040D7CA), ref: 0040779E
                                            • Part of subcall function 00407770: free.MSVCRT(?,?,-00000004,?,00000002,?,00401600), ref: 004077AC
                                          • SetDllDirectoryW.KERNEL32 ref: 00403EA2
                                          • strcmp.MSVCRT ref: 00403EDB
                                          • strcpy.MSVCRT ref: 00403F28
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: EnvironmentVariablefreestrcpy$DirectoryFileModuleNamecallocfclosestrcmpstrlen
                                          • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                          • API String ID: 3041748488-3602715111
                                          • Opcode ID: 768be83e8ff3a33b0980ba9665766b318ff6543d5b006575faa26a0d4c761c3c
                                          • Instruction ID: 81834f9b1efb18d84d1230dad00edf6ea56ed27c7a1d01e0e46bb9e00272f83c
                                          • Opcode Fuzzy Hash: 768be83e8ff3a33b0980ba9665766b318ff6543d5b006575faa26a0d4c761c3c
                                          • Instruction Fuzzy Hash: 0FD1F8B09097018AD710AF75D58425FBBE8AF84345F01893FE9D8A7381E738D985CF96
                                          Function 00405490 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 133COMMON
                                          Download Yara Rule
                                          Strings
                                          • pyi-, xrefs: 00405554
                                          • Failed to convert Wflag %s using mbstowcs (invalid multibyte string), xrefs: 00405697
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Failed to convert Wflag %s using mbstowcs (invalid multibyte string)$pyi-
                                          • API String ID: 0-3625900369
                                          • Opcode ID: b82ee6a41f0246c7b60d63f8347de0f5df44efc621638f2d70a5ca26f7bbdf59
                                          • Instruction ID: 53111416b2da41d66908906ea93154b7d6de6c86b10f1f3900d8cec0b1898ba9
                                          • Opcode Fuzzy Hash: b82ee6a41f0246c7b60d63f8347de0f5df44efc621638f2d70a5ca26f7bbdf59
                                          • Instruction Fuzzy Hash: 33513CB05097009FD710AF65D98476ABBE0FB45304F82482EE8C8AB391D3BDD885CF5A
                                          Function 004019C0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 141COMMON
                                          Download Yara Rule
                                          APIs
                                          • malloc.MSVCRT ref: 00401A0D
                                          • fread.MSVCRT ref: 00401A94
                                          • free.MSVCRT(?,?,?,?,0040638C,?,?,?,?,?,?,?,?,00000000,?,004040A4), ref: 00401ACF
                                          • fclose.MSVCRT ref: 00401AE5
                                          Strings
                                          • Failed to extract %s: failed to read data chunk!, xrefs: 00401AAD
                                          • fseek, xrefs: 00401B7F
                                          • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401B73
                                          • Failed to extract %s: failed to open archive file!, xrefs: 00401B55
                                          • fread, xrefs: 00401AB5
                                          • Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00401BA7
                                          • malloc, xrefs: 00401BB2
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclosefreadfreemalloc
                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                          • API String ID: 3295367466-3659356012
                                          • Opcode ID: 8884fdb84953ef4ecbf5526515473dd84cde1690139ba998021ef6e9a9ea1245
                                          • Instruction ID: c4bf1cbcbd5ed2c421977dfe96b942ab9f05e938e4513c73373e5f6d25da3068
                                          • Opcode Fuzzy Hash: 8884fdb84953ef4ecbf5526515473dd84cde1690139ba998021ef6e9a9ea1245
                                          • Instruction Fuzzy Hash: A25103B16093019FD700EF2AD49461BBBE4AF85744F05882EF988DB351E779D885CF8A
                                          Function 00405907 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 88COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • out of memory, xrefs: 00405A3A
                                          • Fatal error: unable to decode the command line argument #%i, xrefs: 004059EB
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$setlocale$_strdupcalloc
                                          • String ID: Fatal error: unable to decode the command line argument #%i$out of memory
                                          • API String ID: 3058678114-3355598041
                                          • Opcode ID: 82e1e586b294b392402f47a5caf2ca513f1388d1a5a1a0f0118e5191c02fd9f6
                                          • Instruction ID: 3c8cf5d1830a856620667b4546970957c4b2e71bcab9539e8d8fe080ce2f005d
                                          • Opcode Fuzzy Hash: 82e1e586b294b392402f47a5caf2ca513f1388d1a5a1a0f0118e5191c02fd9f6
                                          • Instruction Fuzzy Hash: BD313AB16087118FD710AF69E58526FBBE0EF40318F06482EE9C497341E77DD885CB9A
                                          Function 00405C49 Relevance: 18.1, APIs: 2, Strings: 10, Instructions: 88COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                            • Part of subcall function 00408C20: calloc.MSVCRT ref: 00408C3D
                                            • Part of subcall function 00408C20: free.MSVCRT ref: 00408C88
                                            • Part of subcall function 00408C20: free.MSVCRT ref: 00408C96
                                          • free.MSVCRT ref: 00405C26
                                          • free.MSVCRT ref: 00405C34
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$ByteCharMultiWidecalloc
                                          • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$Invalid value for PYTHONUTF8=%s; disabling utf-8 mode!$\$\$base_library.zip$lib-dynload
                                          • API String ID: 3975185072-2560864920
                                          • Opcode ID: adbe956365aedb5869d1d07a265270035179c80d4643125045a902af79938b7f
                                          • Instruction ID: 4f34d637e5975f622271dbaeae991fb6a0a455f2055f84ceed78d6860252850e
                                          • Opcode Fuzzy Hash: adbe956365aedb5869d1d07a265270035179c80d4643125045a902af79938b7f
                                          • Instruction Fuzzy Hash: EF414AB0609711DFE310AF21E94825BBBE4FF48344F41882EE9C997390D7B89586CF5A
                                          Function 00402370 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 145COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                          • String ID: P%
                                          • API String ID: 2147705588-2959514604
                                          • Opcode ID: 4779583b6165d53cbf8f2ebd436e25e3f78b969fa8961c87bf186bca652e6f9b
                                          • Instruction ID: ab84631f0651d0ee5a96381c4044ee0ed1be7ca295fb525e9842aa76770568ef
                                          • Opcode Fuzzy Hash: 4779583b6165d53cbf8f2ebd436e25e3f78b969fa8961c87bf186bca652e6f9b
                                          • Instruction Fuzzy Hash: FE51F8B19083108FC714EF29D58826ABBF0BF88711F45897EFC898B356E7788544DB62
                                          Function 0040D980 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • VirtualQuery failed for %d bytes at address %p, xrefs: 0040DB17
                                          • Address %p has no image-section, xrefs: 0040DB2B
                                          • VirtualProtect failed with code 0x%x, xrefs: 0040DAE6
                                          • Mingw-w64 runtime failure:, xrefs: 0040D9A8
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: QueryVirtualabortfwritevfprintf
                                          • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
                                          • API String ID: 2513968241-1534286854
                                          • Opcode ID: 5c2ecd956853b343dac6192357bd0367a738e9911806a7d503f452befc2f41a7
                                          • Instruction ID: 12c366034f147c51322be65863a430c13289ac5cb36f6d5ee6a9828dd919d681
                                          • Opcode Fuzzy Hash: 5c2ecd956853b343dac6192357bd0367a738e9911806a7d503f452befc2f41a7
                                          • Instruction Fuzzy Hash: C7514EB19083018FC710EF69D88565BFBF0FF84354F45896EE88997255E738E844CB9A
                                          Function 004061B0 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 143stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Cannot allocate memory for necessary files., xrefs: 0040639F
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: memcpystrncpy$malloc$callocfreestrlenstrncat
                                          • String ID: Cannot allocate memory for necessary files.
                                          • API String ID: 1441568290-2795144771
                                          • Opcode ID: 911552b35a245790c964822b8ef5d942a4fe4b7b21c60f757b82a0e17b75a1fd
                                          • Instruction ID: 3dc4d87da5770e9ddebe32c392722ba7e048c8290a166a4e568edb3e8c8cc1ad
                                          • Opcode Fuzzy Hash: 911552b35a245790c964822b8ef5d942a4fe4b7b21c60f757b82a0e17b75a1fd
                                          • Instruction Fuzzy Hash: F35105B16093018FC714EF65C08469ABBE4FF88314F12892EE9C997351E778E588CB86
                                          Function 00406410 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • SPLASH: Cannot extract requirement %s., xrefs: 00406629
                                          • SPLASH: Cannot find requirement %s in archive., xrefs: 0040653D
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlenstrncpy$callocfreememcpystrcmp
                                          • String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.
                                          • API String ID: 1148940474-4094522769
                                          • Opcode ID: 6f7344fd9e2b8a238fed55bc04f9f176e9703f704dcf6b52d8a3a35027e7dce5
                                          • Instruction ID: eeb11d6563064941a90a30efff23fdfd712fb47c201b2447917d1c532d445a23
                                          • Opcode Fuzzy Hash: 6f7344fd9e2b8a238fed55bc04f9f176e9703f704dcf6b52d8a3a35027e7dce5
                                          • Instruction Fuzzy Hash: 8B51E4B05097059FC324EF25D58529FFBE0BF84744F02882EEAC997352D7789884DB96
                                          Function 00405AA1 Relevance: 16.6, APIs: 2, Strings: 9, Instructions: 86COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$\$\$base_library.zip$lib-dynload
                                          • API String ID: 1294909896-729638271
                                          • Opcode ID: ef64446728c2080087c71a493b58b8590e796b5ae5cde7a7036147615cfb8823
                                          • Instruction ID: 1f7a57bb88f92124875474453c602a743d3be9c2356b80e19fcfa62188903238
                                          • Opcode Fuzzy Hash: ef64446728c2080087c71a493b58b8590e796b5ae5cde7a7036147615cfb8823
                                          • Instruction Fuzzy Hash: A74139B06097109FE310AF20E94825BBBE0FF44344F81882EE9C997390D7B89485CF5A
                                          Function 00407FD0 Relevance: 15.1, APIs: 10, Instructions: 77fileCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004046B0: _wfopen.MSVCRT ref: 00404703
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E4A
                                            • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407E5C
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E7B
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E8F
                                            • Part of subcall function 00407DD0: strcpy.MSVCRT(?,?,00000000), ref: 00407EA3
                                            • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407EB7
                                            • Part of subcall function 00407DD0: _wstat.MSVCRT ref: 00407EE1
                                          • feof.MSVCRT ref: 00408033
                                          • fread.MSVCRT ref: 00408057
                                          • ferror.MSVCRT ref: 00408063
                                          • clearerr.MSVCRT ref: 00408074
                                          • fwrite.MSVCRT ref: 00408093
                                          • ferror.MSVCRT ref: 0040809F
                                          • clearerr.MSVCRT ref: 004080B0
                                          • fclose.MSVCRT ref: 004080B8
                                          • fclose.MSVCRT ref: 004080C0
                                          • fclose.MSVCRT ref: 004080E3
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclosestrlen$clearerrferrorstrtok$_wfopen_wstatfeoffreadfwritestrcpy
                                          • String ID:
                                          • API String ID: 3104166669-0
                                          • Opcode ID: 5129a295bf3d7465ed589c74a8b46aec7613a5adb7438a7249500ed6fb567e41
                                          • Instruction ID: e6213c5d7688b8fe1ba8341ac8fdb9db29b335e178dc78efa11f235658ae9a09
                                          • Opcode Fuzzy Hash: 5129a295bf3d7465ed589c74a8b46aec7613a5adb7438a7249500ed6fb567e41
                                          • Instruction Fuzzy Hash: 6C2110716087518AD7107F2696812AFB6E4AF84354F07493FE8D4A73C1DB7DC889CB8A
                                          Function 00411E60 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: %*.*s$%-*.*s$%.*s
                                          • API String ID: 0-4054516066
                                          • Opcode ID: f3ac9e74d6ea6427b37e06dd8f71590da5508e7645840674976c8b3a356ca51e
                                          • Instruction ID: 34a7cfded508d75713a3901c6ba7bdf4e42489cc40e2d4f26330675e440d4311
                                          • Opcode Fuzzy Hash: f3ac9e74d6ea6427b37e06dd8f71590da5508e7645840674976c8b3a356ca51e
                                          • Instruction Fuzzy Hash: D74140B16047018BDB148F28C5C5696B7E1BF84354F25866EEE898F36AD339D8C2CB49
                                          Function 00408810 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 66COMMON
                                          Download Yara Rule
                                          APIs
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00408CF4), ref: 0040885C
                                          • calloc.MSVCRT ref: 00408875
                                          • WideCharToMultiByte.KERNEL32 ref: 004088B7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$calloc
                                          • String ID: Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Out of memory.$WideCharToMultiByte$win32_wcs_to_mbs
                                          • API String ID: 1374691127-3831141058
                                          • Opcode ID: c3fa3e70c31a3458ec14f411ced81c1205de6429d75ae9f1c074563e70b42a84
                                          • Instruction ID: 5afcbffd29298bee6e331de86764b825c866944575c44242363fe351b07975aa
                                          • Opcode Fuzzy Hash: c3fa3e70c31a3458ec14f411ced81c1205de6429d75ae9f1c074563e70b42a84
                                          • Instruction Fuzzy Hash: 8521F5B15093059FD310AF66D64835BBBE4EB90358F00892EE4D85B281DBB984889BDB
                                          Function 00408920 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 64COMMON
                                          Download Yara Rule
                                          APIs
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 004089D1
                                          • calloc.MSVCRT ref: 004089EA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$calloc
                                          • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                          • API String ID: 1374691127-27947307
                                          • Opcode ID: 2b09dc83ad61f560e2c3f0a7be34deb6504115085fa0c16350d3644281db57d5
                                          • Instruction ID: 392d32d0dc93c970adbdd4bd206061dd84090e66cdb548403919dc1ed5805d2f
                                          • Opcode Fuzzy Hash: 2b09dc83ad61f560e2c3f0a7be34deb6504115085fa0c16350d3644281db57d5
                                          • Instruction Fuzzy Hash: B021E7B01093028BD310AF66D55831BBAE4EF94758F00892EE4E4572D0D7B9D989DB97
                                          Function 00408374 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • LOADER: failed to allocate argv_pyi: %s, xrefs: 0040842D
                                          • LOADER: failed to strdup argv[%d]: %s, xrefs: 0040840A
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _errnostrerror$_strdupcalloc
                                          • String ID: LOADER: failed to allocate argv_pyi: %s$LOADER: failed to strdup argv[%d]: %s
                                          • API String ID: 4278403329-2782260415
                                          • Opcode ID: 888027ff366d88e196ffac7e22f8e9512d8f32fb5de0ea3c8c6ec2f618f8796d
                                          • Instruction ID: 75a4103835d43aa6c95cb7ec3b6db505b02a0d5b0f758bc2d410c1ae15a23f9c
                                          • Opcode Fuzzy Hash: 888027ff366d88e196ffac7e22f8e9512d8f32fb5de0ea3c8c6ec2f618f8796d
                                          • Instruction Fuzzy Hash: 0A2179B4904711CFC720AF75D94419ABBE0EB45314F514A7EE894A33A1E739E881CB9A
                                          Function 004055C3 Relevance: 13.5, APIs: 9, Instructions: 49COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: setbuf$_fileno_setmodefflush
                                          • String ID:
                                          • API String ID: 1650367497-0
                                          • Opcode ID: 7a9e4e7938dbc5579c4c6519335179e61544e4fd34365661340af95d00fc0a84
                                          • Instruction ID: 4513b405083115c81ca635af3cf8f4969db3efee2aa6dccd88a9e4f4ed2810d7
                                          • Opcode Fuzzy Hash: 7a9e4e7938dbc5579c4c6519335179e61544e4fd34365661340af95d00fc0a84
                                          • Instruction Fuzzy Hash: CB1120B15097108BD7007FB5D59936EBBE0BF45314F83481DD4C897241EBBD94848B9A
                                          Function 0040DE30 Relevance: 12.1, APIs: 8, Instructions: 90COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: signal
                                          • String ID:
                                          • API String ID: 1946981877-0
                                          • Opcode ID: 2b651e1b467f7154d26db624bfdf5758aeaee69f22ed160fdee85f15cbcdd14c
                                          • Instruction ID: 529314676596798a44e2e7d48aea7ed491276213eefa766ee39382917f2d3c55
                                          • Opcode Fuzzy Hash: 2b651e1b467f7154d26db624bfdf5758aeaee69f22ed160fdee85f15cbcdd14c
                                          • Instruction Fuzzy Hash: DD3103B09056018AD7206FB8C84432F76D0AF55728F128A2FE4E5DB3D1DB7DD888979B
                                          Function 00407BC0 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • wcscpy.MSVCRT ref: 00407C07
                                          • wcslen.MSVCRT ref: 00407C0F
                                          • wcscat.MSVCRT ref: 00407C39
                                          • _wfindfirst.MSVCRT ref: 00407C4C
                                          • _wrmdir.MSVCRT ref: 00407C68
                                          • wcscat.MSVCRT ref: 00407CDE
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcscat$ByteCharMultiWide_wfindfirst_wrmdirwcscpywcslen
                                          • String ID:
                                          • API String ID: 955055573-0
                                          • Opcode ID: 802cfa8735c993ec09b655bbe795d2bd26a3e6085fba014a598c9f678fc7b595
                                          • Instruction ID: 812287d127834224555eaebaea1a5f31319f6ec07a572a1decaabcd838263556
                                          • Opcode Fuzzy Hash: 802cfa8735c993ec09b655bbe795d2bd26a3e6085fba014a598c9f678fc7b595
                                          • Instruction Fuzzy Hash: 572117B490D3049BD720AF75D88869EBBE4FB84304F118C3EE9C993251E7389585DB9B
                                          Function 00408B00 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 60COMMON
                                          Download Yara Rule
                                          APIs
                                          • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B91
                                          • calloc.MSVCRT ref: 00408BAA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$calloc
                                          • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                          • API String ID: 1374691127-876015163
                                          • Opcode ID: d6a78e633d9bb543a46de6eff9a097cd2261dbab8d0e33fc600cb80726c8ebad
                                          • Instruction ID: 686223d8df53a97fa17e1b733178636a5c74384edd7780f85d5042dc75bc6c3c
                                          • Opcode Fuzzy Hash: d6a78e633d9bb543a46de6eff9a097cd2261dbab8d0e33fc600cb80726c8ebad
                                          • Instruction Fuzzy Hash: AD2118B05083059FD310AF65C64925ABBF4EB84754F04893EE5E8572C1DBB8D8449B9B
                                          Function 004124D0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 406COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fputwc$memset
                                          • String ID: 0$o
                                          • API String ID: 822753988-4157579757
                                          • Opcode ID: c0d80a03fa09052c1a669441533165b430e64d4749c6fff7dd3072524ed2086e
                                          • Instruction ID: b65a98287eddb54592c783ac7525ef4ab93ad80493cd3b98cbaa9a691208da40
                                          • Opcode Fuzzy Hash: c0d80a03fa09052c1a669441533165b430e64d4749c6fff7dd3072524ed2086e
                                          • Instruction Fuzzy Hash: 79F16F71E102198FDB14CF68C6942DEBBF1BF44310F15822AE865EB385D778E892CB94
                                          Function 0040F730 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 404COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fputc$memset
                                          • String ID: 0$o
                                          • API String ID: 2944404495-4157579757
                                          • Opcode ID: 62ce1c91e6c4f14205547f0573e4b3f914893ff815fa095c8c03e974051d489c
                                          • Instruction ID: 9062061d76251826460344fe4ffb90a7e4f33a362718e540e131347e649c7f22
                                          • Opcode Fuzzy Hash: 62ce1c91e6c4f14205547f0573e4b3f914893ff815fa095c8c03e974051d489c
                                          • Instruction Fuzzy Hash: 2BF14D72E002199FDB24DF68D49069EBBB1BF84310F15817AE859BB785D338E946CF84
                                          Function 00406A75 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 138COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID: _image_data$exit$rename ::source ::_source$source$tclInit$tcl_findLibrary
                                          • API String ID: 1294909896-1126984729
                                          • Opcode ID: b3db61e08089af8a0f48b7dd3434c65c66f42e085b044ee94ceec25c32d68ff5
                                          • Instruction ID: 5837fc7092d7bfd19bff1a36fcf45920a7a04ffe6dc7564dff579a9c2d03099d
                                          • Opcode Fuzzy Hash: b3db61e08089af8a0f48b7dd3434c65c66f42e085b044ee94ceec25c32d68ff5
                                          • Instruction Fuzzy Hash: 3A61F9B8609301CFD710AF64D48821ABBF0FF49344F81897DE9859B350D7B99859CF2A
                                          Function 00411A40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: %-*.*S$%.*S
                                          • API String ID: 0-812388239
                                          • Opcode ID: d3ea50cc3d132d3143849def37d31036af112e818d385dd3d02cc72e2dcc9aec
                                          • Instruction ID: c23151172c0a1ec719629ee0893607804d1b15add0b79fb5692203c1bf32c755
                                          • Opcode Fuzzy Hash: d3ea50cc3d132d3143849def37d31036af112e818d385dd3d02cc72e2dcc9aec
                                          • Instruction Fuzzy Hash: 7D4196B1A097159BC7109F29D4812DEBBE0AF84794F14C52FE5488B361E33DD9C1CB8A
                                          Function 00405CF0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 72stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: freestrlen
                                          • String ID: Failed to get _MEIPASS as PyObject.$Module object for %s is NULL!$_MEIPASS$strict$utf-8
                                          • API String ID: 322734593-985300917
                                          • Opcode ID: 6a5a0fc19d408c57ccd74b2a843a6cf11713645823d17a702bec6b19c546019a
                                          • Instruction ID: b798077ea826a97b31ed519bc33854408a60d385b89e575b30205180b7c9f22a
                                          • Opcode Fuzzy Hash: 6a5a0fc19d408c57ccd74b2a843a6cf11713645823d17a702bec6b19c546019a
                                          • Instruction Fuzzy Hash: 692117B0219B009BC7207F25D98856BBBE4FE80750F45892FE4C997291D7789482DF6B
                                          Function 0040E9C1 Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: freembstowcssetlocalewcstombs$realloc
                                          • String ID:
                                          • API String ID: 2323685431-0
                                          • Opcode ID: 45279616c9b6d3ccdbfd2aaa52830abb573ecc6ee843925474a723046d140ec2
                                          • Instruction ID: 0ece9848e1b9cb63aa0c7ac93180fa40d32587a4740361e1b5221defc5654884
                                          • Opcode Fuzzy Hash: 45279616c9b6d3ccdbfd2aaa52830abb573ecc6ee843925474a723046d140ec2
                                          • Instruction Fuzzy Hash: BA3129B09083159ECB10AF66C1452AEFBF0FF48344F51882FE888A7350E7789995CB86
                                          Function 00403446 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 58stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strcmp
                                          • String ID: %s%c%s%c%s%c%s$%s%c%s.pkg$Failed to extract %s$\$\$\
                                          • API String ID: 1004003707-2076181140
                                          • Opcode ID: d8422f4b8ab908e08704c80b1f056dfc79cd756015d3aaecdf5715272ff86ff7
                                          • Instruction ID: 73055d119674c1d8bf47e55e1769eeb00a0baa58503b6758db3226280ebf56de
                                          • Opcode Fuzzy Hash: d8422f4b8ab908e08704c80b1f056dfc79cd756015d3aaecdf5715272ff86ff7
                                          • Instruction Fuzzy Hash: 602128B1508701ABD7109F25C54414AFBE8BF80719F418D2EE5A8A7390D378EA45CF8A
                                          Function 00407CF0 Relevance: 10.6, APIs: 7, Instructions: 58COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcscmp$wcscat
                                          • String ID:
                                          • API String ID: 545343207-0
                                          • Opcode ID: ae46feb38f9d982e05331aa8471f37b1e1520206203c39296f539e6903441e66
                                          • Instruction ID: 66d593373b9ba32e9ef8b9ba0102b03e4299b10aa04248f83024a0eb22297dfe
                                          • Opcode Fuzzy Hash: ae46feb38f9d982e05331aa8471f37b1e1520206203c39296f539e6903441e66
                                          • Instruction Fuzzy Hash: B5113DB140C7458AD710BF2599842AFBAE4AF50344F02583EE9C597245EB7CA4868B9B
                                          Function 00405E00 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 56stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlen
                                          • String ID: %U?%llu$Failed to append to sys.path$Installing PYZ: Could not get sys.path$path$strict$utf-8
                                          • API String ID: 39653677-2762566162
                                          • Opcode ID: 0a30e1c31abfe84ab274ddb6d250ee1ed9747d53d1c92cc8e44e52a44ddb55f5
                                          • Instruction ID: 2414ad3c8f8d3fc0fbc978f46c10fd6a42ce83d48acf707811ed1e666cf8afaa
                                          • Opcode Fuzzy Hash: 0a30e1c31abfe84ab274ddb6d250ee1ed9747d53d1c92cc8e44e52a44ddb55f5
                                          • Instruction Fuzzy Hash: 6A112EB05093009FC710AF69DA8801EBBE4FF84354F45882EE5D897341D7B88481CF9B
                                          Function 00417510 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: AddressProc$HandleModule
                                          • String ID: ___lc_codepage_func$__lc_codepage$msvcrt.dll
                                          • API String ID: 667068680-1145701848
                                          • Opcode ID: d189fa9efd416f18abebd0a9be443f761bdc61810749ea753c76760930122cfc
                                          • Instruction ID: 1b2e568be5773464d0952ec9ee83d8ba760180256f55db537a2820630d2abbb3
                                          • Opcode Fuzzy Hash: d189fa9efd416f18abebd0a9be443f761bdc61810749ea753c76760930122cfc
                                          • Instruction Fuzzy Hash: E1F049B0848204ABD700AF38AD4418A7EF0AA08314F15863FC889C7210E778D888CBAA
                                          Function 0040ED40 Relevance: 9.2, APIs: 6, Instructions: 158stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _stat$freemallocmemcpystrlen
                                          • String ID:
                                          • API String ID: 2821670080-0
                                          • Opcode ID: 2e2927e48dad086f7b6652f0e1c13a34fbe12bb134b6987c2c9234558f53e84a
                                          • Instruction ID: c5bd95b142fc711015b6ce962a46217c3aa773e4d5f7f4cf9c825846a95b2092
                                          • Opcode Fuzzy Hash: 2e2927e48dad086f7b6652f0e1c13a34fbe12bb134b6987c2c9234558f53e84a
                                          • Instruction Fuzzy Hash: 5B5173715093058FC724DF2AC08026BBBE2AF89304F454D6FE8E49B385D339D956DB8A
                                          Function 0040FCE0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 307COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 0
                                          • API String ID: 0-4108050209
                                          • Opcode ID: 85bd0f672ddd99df0f0a2a81c69a256e0952087e2de33095cd5bd9eaf017051c
                                          • Instruction ID: 433f201fbec311e4d545196cfb57db08f817b2de0d536de69a62510c51185dfe
                                          • Opcode Fuzzy Hash: 85bd0f672ddd99df0f0a2a81c69a256e0952087e2de33095cd5bd9eaf017051c
                                          • Instruction Fuzzy Hash: 46C15D71A042058FDB24CF68C48079EBBF1BF89354F18817AE849AB796D339EC45CB95
                                          Function 00412A90 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 294COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 0
                                          • API String ID: 0-4108050209
                                          • Opcode ID: 7adf794be4c6c9f156d55b57fe4938e6437273bc955ed6dda0050f882a06c093
                                          • Instruction ID: 5dacb983aef9c9090e06cba1bb9e4627a9a1d687151f3e630a54116cb97c77b1
                                          • Opcode Fuzzy Hash: 7adf794be4c6c9f156d55b57fe4938e6437273bc955ed6dda0050f882a06c093
                                          • Instruction Fuzzy Hash: ABC15C71A042058BDB14CF28C6847DEBBF1BF88340F19855AE949EB355E378EC91CB99
                                          Function 00407564 Relevance: 8.8, APIs: 7, Instructions: 77stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlen$malloc
                                          • String ID:
                                          • API String ID: 3157260142-0
                                          • Opcode ID: 0610461012db69685dc33115d6b204908d610f74a8049d1f7c086d9be229f820
                                          • Instruction ID: 6a25df0a465119ab13b362e17adcb34b3197186f0404beced398dc7aaf439a95
                                          • Opcode Fuzzy Hash: 0610461012db69685dc33115d6b204908d610f74a8049d1f7c086d9be229f820
                                          • Instruction Fuzzy Hash: B5217175A0A7059BC710AF6988846ABB7E0FF84750F46493EF8C497341FA39EC41C796
                                          Function 00403030 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _errno.MSVCRT ref: 00403064
                                          • strerror.MSVCRT ref: 0040306F
                                            • Part of subcall function 00402DF0: MessageBoxW.USER32 ref: 00402E78
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Message_errnostrerror
                                          • String ID: %s%s: %s$0$Fatal error detected
                                          • API String ID: 132859757-319980707
                                          • Opcode ID: 75b9b436fd89f2a30938fcb7b058be5ee0d31631848f3b8384897b5255f1b178
                                          • Instruction ID: e4a221d579113a631f8ff3878a8ccab0824710bde975c9094fb448246fb893e6
                                          • Opcode Fuzzy Hash: 75b9b436fd89f2a30938fcb7b058be5ee0d31631848f3b8384897b5255f1b178
                                          • Instruction Fuzzy Hash: 540180B4409345DFC750EF65D18464ABBE0FF88749F408C2EE4C897251EB789948DF96
                                          Function 00402A70 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DialogLongWindow$InvalidateRect
                                          • String ID:
                                          • API String ID: 1200242243-0
                                          • Opcode ID: 3787fa5d93e67dc4f7c943341e9a8d3195f1a3fb92f8390d8411d98647bb4722
                                          • Instruction ID: 27a3fa5a97dc3583b937ce51c481d096ba8d8761c7d493d8dec02a740509071e
                                          • Opcode Fuzzy Hash: 3787fa5d93e67dc4f7c943341e9a8d3195f1a3fb92f8390d8411d98647bb4722
                                          • Instruction Fuzzy Hash: 1A2160715082108FD310AF2CDA8925EBBE0FB84704F01893EF88A973D5D7B98949CB97
                                          Function 004038E1 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID: %s%c%s.py$\$__file__$_pyi_main_co
                                          • API String ID: 1294909896-1862493962
                                          • Opcode ID: 46cf789b736286b4a61b83edaca85d21ba6631443c1c9059bb822cdedcba4429
                                          • Instruction ID: c970f6cc1162f0d106d27565064d24bae80cc5d647643b18d1f9b1af61abd66d
                                          • Opcode Fuzzy Hash: 46cf789b736286b4a61b83edaca85d21ba6631443c1c9059bb822cdedcba4429
                                          • Instruction Fuzzy Hash: 58219BB4909701EFC710AF24C18865ABFE4BF88745F41892EE8C993350E7B8D985DF4A
                                          Function 0040EA58 Relevance: 7.5, APIs: 5, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcstombs$freereallocsetlocale
                                          • String ID:
                                          • API String ID: 3931877334-0
                                          • Opcode ID: 1b61a0e1aaeda8027505282be700259d65b027cda1d85ed728b5ca162101692f
                                          • Instruction ID: e696c5700d6393410b77d795bc353bc03d311abb2f38c8898df76e4b882a8a07
                                          • Opcode Fuzzy Hash: 1b61a0e1aaeda8027505282be700259d65b027cda1d85ed728b5ca162101692f
                                          • Instruction Fuzzy Hash: 7C01D6B19093159FCB00AF65D64529EFBF0FF44344F12886EE488A7251E3789985CBCA
                                          Function 0040E887 Relevance: 7.5, APIs: 5, Instructions: 31COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcstombs$freereallocsetlocale
                                          • String ID:
                                          • API String ID: 3931877334-0
                                          • Opcode ID: b9a3e2769ecb59adbd2afba563b8b068b0a70107dd94f56d983b6df17b883f0b
                                          • Instruction ID: 3383cd8d3157cb3ed617c2d5b5c50993071427c57053a183d1f18b1378754ef2
                                          • Opcode Fuzzy Hash: b9a3e2769ecb59adbd2afba563b8b068b0a70107dd94f56d983b6df17b883f0b
                                          • Instruction Fuzzy Hash: 3DF0ECB19093009FCB40AF69D44529EFBE0EF84344F02CD6EE4D897211E7789895CB86
                                          Function 0040807B Relevance: 7.5, APIs: 5, Instructions: 26fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: clearerrfcloseferror$feoffreadfwrite
                                          • String ID:
                                          • API String ID: 2607417955-0
                                          • Opcode ID: e23c38ce40b9de981818dbabdb75aa260bd4a35cb26f3327470fa7c9e50a8650
                                          • Instruction ID: 6caf015234ffb0fe8031e1673ea91487ed83400b7f12cc8799a42872fabf3f27
                                          • Opcode Fuzzy Hash: e23c38ce40b9de981818dbabdb75aa260bd4a35cb26f3327470fa7c9e50a8650
                                          • Instruction Fuzzy Hash: D3E0AC71609B104AD3107F26A58116EF6E4AF80354F07492FE8E497291D77DC4C58B86
                                          Function 004045D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleFileNameW.KERNEL32(00000000,00403DA0), ref: 004045F4
                                            • Part of subcall function 00408920: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                          Strings
                                          • GetModuleFileNameW, xrefs: 00404638
                                          • Failed to convert executable path to UTF-8., xrefs: 00404650
                                          • Failed to get executable path., xrefs: 00404630
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharFileModuleMultiNameWide
                                          • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                          • API String ID: 1532159127-1977442011
                                          • Opcode ID: 748dc92c4a3665e52a64521ebb29f00cda33f6c131056bcfed0b1391d42d2669
                                          • Instruction ID: 0d2fa86ab14f13f7fcc6e2807861f5dff99018acd92cf068427be3d6d0997f9d
                                          • Opcode Fuzzy Hash: 748dc92c4a3665e52a64521ebb29f00cda33f6c131056bcfed0b1391d42d2669
                                          • Instruction Fuzzy Hash: 7FF031B09083008BE700BF75D14925ABAE0AB94345F548C3EE8C887285E77E85989697
                                          Function 00408987 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                          Download Yara Rule
                                          APIs
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                            • Part of subcall function 00402F90: GetLastError.KERNEL32 ref: 00402F98
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 004089D1
                                          • calloc.MSVCRT ref: 004089EA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$ErrorLastcalloc
                                          • String ID: Out of memory.$win32_utils_to_utf8
                                          • API String ID: 2784544953-3983694475
                                          • Opcode ID: 21bcc7d080ca5c9db2f0063a8681e6bc7762e4e6dc2f13102dfe4c2287896f93
                                          • Instruction ID: 7d0191ab155d1c36bf02162991644b0c6808e0cf9adbb8e4045d17a736bf9196
                                          • Opcode Fuzzy Hash: 21bcc7d080ca5c9db2f0063a8681e6bc7762e4e6dc2f13102dfe4c2287896f93
                                          • Instruction Fuzzy Hash: 5D0119B01083028FE310AF65D55835ABBE0EB80358F01893EE4E85B3D0D7B9C5498B87
                                          Function 004174C8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: atoisetlocalestrchr
                                          • String ID: .
                                          • API String ID: 1223908000-248832578
                                          • Opcode ID: 93559f69e0f89921f206570d2a278c7facffb9e7d98682812659cee062819bc8
                                          • Instruction ID: 5ece903d628136d3021f03f5de1dba085c6daeff515edd77d6e3c8bfb4f9f80e
                                          • Opcode Fuzzy Hash: 93559f69e0f89921f206570d2a278c7facffb9e7d98682812659cee062819bc8
                                          • Instruction Fuzzy Hash: 18E08CB0A087004BD7007F39C40A35BB6E2AB80308F8A882CE4CC87701F73DC8858786
                                          Function 00404DA3 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 18libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: AddressProc$ErrorLast
                                          • String ID: Failed to get address for Py_UTF8Mode$GetProcAddress$Py_UTF8Mode
                                          • API String ID: 4214558900-2336683375
                                          • Opcode ID: ce3f0de93563fe4047d9d5d54811ed0c466457a72e603fabebd0357acd7d67ad
                                          • Instruction ID: 29490028243a8bc7eb143a8c508494385d0dcc63e20c03701c217239cd601c8a
                                          • Opcode Fuzzy Hash: ce3f0de93563fe4047d9d5d54811ed0c466457a72e603fabebd0357acd7d67ad
                                          • Instruction Fuzzy Hash: B7E0ECB18096108AC7106F39AA5519ABBE4BA4072CF018A2EE998572C0D778A985968E
                                          Function 00416DF0 Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                          Download Yara Rule
                                          APIs
                                          • IsDBCSLeadByteEx.KERNEL32 ref: 00416E42
                                          • MultiByteToWideChar.KERNEL32 ref: 00416E85
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$CharLeadMultiWide
                                          • String ID:
                                          • API String ID: 2561704868-0
                                          • Opcode ID: 34c0aafb8afc26c9c968cb039ac2f52e38f4d15ab9367f4157b8da4b37fd940f
                                          • Instruction ID: 73686868ec51103a6e9184972a812ecf3e9551738ac5fc900f4de2194f72883f
                                          • Opcode Fuzzy Hash: 34c0aafb8afc26c9c968cb039ac2f52e38f4d15ab9367f4157b8da4b37fd940f
                                          • Instruction Fuzzy Hash: 6441F5B55093518FD710DF28E48429BBBE0BF86314F158A6EF89487390D77AD889CB87
                                          Function 00401001 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: __p__commode__p__fmode__set_app_type
                                          • String ID:
                                          • API String ID: 3338496922-0
                                          • Opcode ID: c3091d54fea95446ff7c3ee7b6d7815346795e8d6a3ffecbbf37e06955004e2c
                                          • Instruction ID: aeb446e45a19cd1e2d7087c0f9dd5afe65501be8eb4055b43830eca8bb231281
                                          • Opcode Fuzzy Hash: c3091d54fea95446ff7c3ee7b6d7815346795e8d6a3ffecbbf37e06955004e2c
                                          • Instruction Fuzzy Hash: 2B219370600201CBD314AF30D8667A737E1BB00348F55867ED4887BAA6D77ED8C6DB99
                                          Function 004043B0 Relevance: 6.1, APIs: 4, Instructions: 54stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlenstrncat
                                          • String ID:
                                          • API String ID: 3854678441-0
                                          • Opcode ID: 024b53f308501637485ded2f28a26100731e6414f1d197708657ac8333189728
                                          • Instruction ID: a1bd85adc18dd833a72da197840ca80eebc8a3fb90e726dddcfc8ac31c193ccc
                                          • Opcode Fuzzy Hash: 024b53f308501637485ded2f28a26100731e6414f1d197708657ac8333189728
                                          • Instruction Fuzzy Hash: 431154B160C7404EE710BF2DE88935FBBD0EB85358F064DAFE5C457346D27984848B96
                                          Function 00402CE0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                          Download Yara Rule
                                          APIs
                                          • free.MSVCRT ref: 00402D67
                                          • free.MSVCRT ref: 00402D6F
                                          • free.MSVCRT ref: 00402D77
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          Strings
                                          • Failed to obtain/convert traceback!, xrefs: 00402D2F
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$ByteCharMultiWide
                                          • String ID: Failed to obtain/convert traceback!
                                          • API String ID: 3219091393-982972847
                                          • Opcode ID: 052f5b771e97f46218db83959d6fe6f4ff6f8b7ba96841d2be7dde76f27d9c66
                                          • Instruction ID: b1da0bbaf139879325ca28b011b54c10ba95b71f8749f1078afd24c14b703eba
                                          • Opcode Fuzzy Hash: 052f5b771e97f46218db83959d6fe6f4ff6f8b7ba96841d2be7dde76f27d9c66
                                          • Instruction Fuzzy Hash: 380157B16097009BD700BF6A959531FFAE4AF84744F06482EF8C897381DBB898458B9A
                                          Function 0040E7F1 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcstombs$freereallocsetlocale
                                          • String ID:
                                          • API String ID: 3931877334-0
                                          • Opcode ID: af4a0adfe83bc6257ce74bebce9e2fbec335e63f4a836b3755766f42b92495f7
                                          • Instruction ID: d41dfc4cb9d2f32e5806314ff69e05ab86441aac7deb837ed49f13012e92ac7c
                                          • Opcode Fuzzy Hash: af4a0adfe83bc6257ce74bebce9e2fbec335e63f4a836b3755766f42b92495f7
                                          • Instruction Fuzzy Hash: 35012971E04714DBCB109F69D44139EFBF0FF88314F12896EE499A7391D37898518B96
                                          Function 0040598B Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Fatal error: unable to decode the command line argument #%i, xrefs: 004059EB
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$setlocale
                                          • String ID: Fatal error: unable to decode the command line argument #%i
                                          • API String ID: 294139027-810459673
                                          • Opcode ID: 9d1a7e72fccc39349e8435cb77fec3904dd9347efbe4d5a34812376667be7cae
                                          • Instruction ID: f47e09dd697b96e2b59eaf830e36c8aa388eac640d0f1e900355e8c5eb1699ce
                                          • Opcode Fuzzy Hash: 9d1a7e72fccc39349e8435cb77fec3904dd9347efbe4d5a34812376667be7cae
                                          • Instruction Fuzzy Hash: 86011DB5A047018FDB10AF69E88526ABBE0EF05314F46093EE9C4A7341D33DE8858B99
                                          Function 00408B57 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 32COMMON
                                          Download Yara Rule
                                          APIs
                                          • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                            • Part of subcall function 00402F90: GetLastError.KERNEL32 ref: 00402F98
                                          • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B91
                                          • calloc.MSVCRT ref: 00408BAA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$ErrorLastcalloc
                                          • String ID: Out of memory.$win32_utils_from_utf8
                                          • API String ID: 2784544953-2800126769
                                          • Opcode ID: ec2cb1e5026d3fc4b67ab3b6410801d6944346cc6d37ed0befe9e1bdfa6c4f47
                                          • Instruction ID: fcbae36c43b134958f39cc4fef673158ef90f98619c8ac1ec6a6b109632cf1fa
                                          • Opcode Fuzzy Hash: ec2cb1e5026d3fc4b67ab3b6410801d6944346cc6d37ed0befe9e1bdfa6c4f47
                                          • Instruction Fuzzy Hash: F7F04FB01083028FD300AF25D50535AB7E0BB80354F05893EE4E85B281D779D4498B86
                                          Function 00402F90 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 32COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32 ref: 00402F98
                                            • Part of subcall function 004086F0: FormatMessageW.KERNEL32(?,?,?,?,00402FD9), ref: 0040873F
                                            • Part of subcall function 004086F0: WideCharToMultiByte.KERNEL32 ref: 00408787
                                            • Part of subcall function 00402DF0: MessageBoxW.USER32 ref: 00402E78
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Message$ByteCharErrorFormatLastMultiWide
                                          • String ID: %s%s: %s$0$Fatal error detected
                                          • API String ID: 254840284-319980707
                                          • Opcode ID: 0c3db0587474ba41661a36650c9661a93dd5b94a7b7985aca411cfd2fb9549be
                                          • Instruction ID: 073ad40fe3aa3b4c51d3ea82456dca4d4efc994dc50aa159961d7af2ea3959c7
                                          • Opcode Fuzzy Hash: 0c3db0587474ba41661a36650c9661a93dd5b94a7b7985aca411cfd2fb9549be
                                          • Instruction Fuzzy Hash: 3E01C0B14093419FD320AF29D58428ABBE0BF88708F01882EE4C897251DB789988CF97
                                          Function 004066E0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 14COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: calloc
                                          • String ID: 0@$Cannot allocate memory for SPLASH_STATUS.$calloc
                                          • API String ID: 2635317215-3108904453
                                          • Opcode ID: e9ae53ffb00be03242b8a08f96269f3c0e4721a38ac4aee35946d78fdc8c9888
                                          • Instruction ID: 91d9d8c6ef22e38f4f1b4844de6a5a16a8ab255c7dc3ef68476b647e8a5c5417
                                          • Opcode Fuzzy Hash: e9ae53ffb00be03242b8a08f96269f3c0e4721a38ac4aee35946d78fdc8c9888
                                          • Instruction Fuzzy Hash: 0DD012B080E3008AC300AF21C15525E7AE4AF40704F85882EE5C557280D3BDC5959B8B
                                          Function 0040DB40 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 195COMMON
                                          Download Yara Rule
                                          Strings
                                          • Unknown pseudo relocation protocol version %d., xrefs: 0040DDAD
                                          • Unknown pseudo relocation bit size %d., xrefs: 0040DC4C
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                          • API String ID: 0-395989641
                                          • Opcode ID: efeab4ecc8cf7299757ce823f27793ae6324061fd86fa164cff4e97c8fde8b6b
                                          • Instruction ID: 5a79fb0c569983318be0eb92f73853d4612fcc90bcd5073555eddd72529e42a9
                                          • Opcode Fuzzy Hash: efeab4ecc8cf7299757ce823f27793ae6324061fd86fa164cff4e97c8fde8b6b
                                          • Instruction Fuzzy Hash: E271B175D042058BDB00DFA9D88029ABBF1FFC4344F25857AD888A7395D738A859CB8D
                                          Function 004124C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fputwc$memset
                                          • String ID: o
                                          • API String ID: 822753988-252678980
                                          • Opcode ID: 9fd6ffc3a2fae0cfd560b27fc0f11d1b2788c49dfba611f968ff3f0046a73d11
                                          • Instruction ID: 0dfbfd20a5ff8b44feb81e2e93b8d7a761d81825f22629ca31478565f12853d3
                                          • Opcode Fuzzy Hash: 9fd6ffc3a2fae0cfd560b27fc0f11d1b2788c49dfba611f968ff3f0046a73d11
                                          • Instruction Fuzzy Hash: 5B61F572E002198FCB14CF68D5806DEBBF1AF48350F19816AE858EB385D374E9968B94
                                          Function 0040D8E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Unknown error, xrefs: 0040D8E2
                                          • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0040D92F
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fprintf
                                          • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                          • API String ID: 383729395-3474627141
                                          • Opcode ID: f74ba067b4a2145830e725ba5a059d72fea62b42937aab84030ba012b91b4e73
                                          • Instruction ID: d090ae441ae7ed191b2c3bbd373a08a5730f8df06674ae97c57d609341765c89
                                          • Opcode Fuzzy Hash: f74ba067b4a2145830e725ba5a059d72fea62b42937aab84030ba012b91b4e73
                                          • Instruction Fuzzy Hash: DD01E4B0508B85DBD300AF15E48845AFFF1FF89350F82889DF5C846269CB36D8A8C74A
                                          Function 00415E10 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Sleep.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E37
                                          • InitializeCriticalSection.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E74
                                          • InitializeCriticalSection.KERNEL32(?,?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E80
                                          • EnterCriticalSection.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415EA8
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: CriticalSection$Initialize$EnterSleep
                                          • String ID:
                                          • API String ID: 1117354567-0
                                          • Opcode ID: d7b42fd4e733c284aa8614d4c2843ab90d0827d89210ebc45ef6cd9b7a9f8079
                                          • Instruction ID: 8d4cea6e3eae5d5154d2418d5b7341923ef78fd17797a7ba2a2094ec0acf5e62
                                          • Opcode Fuzzy Hash: d7b42fd4e733c284aa8614d4c2843ab90d0827d89210ebc45ef6cd9b7a9f8079
                                          • Instruction Fuzzy Hash: FC113771804604CBDB65AB2CE9D51EF37A4F740300F652636D445C7324E779D9C8C69E
                                          Function 0040DFE0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040DFEE
                                          • TlsGetValue.KERNEL32(?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E015
                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E01C
                                          • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E03C
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: CriticalSection$EnterErrorLastLeaveValue
                                          • String ID:
                                          • API String ID: 682475483-0
                                          • Opcode ID: be30760642f5f923f25c22eccc3533437ca06620e5a78a3e64c9a32c5ac432c0
                                          • Instruction ID: ec43abde3d5bb8c9cd3b17ef075de6dc33701065addaa06d31121f0b361238c5
                                          • Opcode Fuzzy Hash: be30760642f5f923f25c22eccc3533437ca06620e5a78a3e64c9a32c5ac432c0
                                          • Instruction Fuzzy Hash: 6FF028B55003118BD710BF79E8C890B7BF4EB04740F0505B9DD848B325E774AC19CBAA
                                          Function 00406720 Relevance: 5.0, APIs: 4, Instructions: 29COMMON
                                          Download Yara Rule
                                          APIs
                                          • free.MSVCRT(-00000004,?,00000002), ref: 0040673C
                                          • free.MSVCRT(-00000004,?,00000002), ref: 0040674E
                                          • free.MSVCRT(-00000004,?,00000002), ref: 00406760
                                          • free.MSVCRT(-00000004,?,00000002), ref: 00406768
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.2577165458.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000001.00000002.2577055053.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577265198.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577423318.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577518743.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000001.00000002.2577592882.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID:
                                          • API String ID: 1294909896-0
                                          • Opcode ID: f1f19a07b2916ba5163eaa3879dfc33869d61147520d0c246ce0b263a20fc7fb
                                          • Instruction ID: 7fa97c1622dad13d69692f5ac932c0fb64940c2aa2579b211d90da9c96ec3935
                                          • Opcode Fuzzy Hash: f1f19a07b2916ba5163eaa3879dfc33869d61147520d0c246ce0b263a20fc7fb
                                          • Instruction Fuzzy Hash: 34F0FEB56143004BDF20BF35B4C565A7BE4AF00748F4B087DED85AB242E738D8908B69

                                          Execution Graph

                                          Execution Coverage:0.5%
                                          Dynamic/Decrypted Code Coverage:0%
                                          Signature Coverage:0%
                                          Total number of Nodes:308
                                          Total number of Limit Nodes:25
                                          execution_graph 49935 404300 49936 40430b 49935->49936 49943 4042d0 49936->49943 49941 4042d0 3 API calls 49942 40436b 49941->49942 49966 40f100 49943->49966 49945 4042f7 49945->49942 49946 40e900 setlocale 49945->49946 49947 40e923 _strdup 49946->49947 49948 40e92d setlocale 49946->49948 49947->49948 49949 40e950 wcstombs realloc wcstombs setlocale free 49948->49949 49950 40e948 49948->49950 49952 404348 49949->49952 49950->49949 49951 40e9c8 mbstowcs 49950->49951 49975 40e630 49951->49975 49952->49941 49955 40ea42 49957 40ea6e 49955->49957 49959 40ea80 49955->49959 49956 40ea21 49956->49955 49958 40ec55 setlocale free 49956->49958 49957->49949 49958->49952 49960 40eae1 wcstombs realloc wcstombs 49959->49960 49965 40eb70 wcstombs 49959->49965 49962 40eb4e setlocale free 49960->49962 49962->49952 49964 40ecc2 49964->49962 49965->49962 49965->49964 49967 40f150 49966->49967 49968 40f119 49966->49968 49974 411040 fputc _errno fputc 49967->49974 49973 411040 fputc _errno fputc 49968->49973 49971 40f138 49971->49945 49972 40f170 49972->49945 49973->49971 49974->49972 49976 40e63d mbstowcs 49975->49976 49976->49955 49976->49956 49977 408100 49980 408b00 49977->49980 49981 408b60 MultiByteToWideChar 49980->49981 49982 408b13 49980->49982 49983 408bf8 49981->49983 49984 408b9c calloc 49981->49984 49985 408b1d MultiByteToWideChar 49982->49985 49995 402f90 12 API calls 49983->49995 49984->49985 49986 408bb9 49984->49986 49987 408bd8 49985->49987 49992 408121 LoadLibraryExW free 49985->49992 49993 402f90 12 API calls 49986->49993 49994 402f90 12 API calls 49987->49994 49991 408bcd 49991->49992 49993->49991 49994->49992 49995->49992 49996 401e60 49997 402020 49996->49997 49998 401e75 49996->49998 50044 4046b0 49997->50044 50002 402014 49998->50002 50025 408550 malloc 49998->50025 50001 401eaa 50001->50002 50036 40ef60 50001->50036 50005 401ed4 fread 50008 402061 50005->50008 50009 401efd 50005->50009 50006 40208f 50052 403030 14 API calls 50006->50052 50051 403030 14 API calls 50008->50051 50011 40ef60 6 API calls 50009->50011 50012 401f57 malloc 50011->50012 50013 4020a5 50012->50013 50014 401f6d fread 50012->50014 50053 403030 14 API calls 50013->50053 50016 402046 50014->50016 50017 401f8f ferror 50014->50017 50050 403030 14 API calls 50016->50050 50019 40207c 50017->50019 50022 401fac 50017->50022 50020 402ed0 12 API calls 50019->50020 50020->50002 50021 401ff6 50021->50002 50023 402006 fclose 50021->50023 50022->50021 50039 402ed0 50022->50039 50023->50002 50026 408571 50025->50026 50032 4086b2 free 50025->50032 50027 40ef60 6 API calls 50026->50027 50029 40858d 50027->50029 50029->50032 50054 40f050 50029->50054 50031 4085a1 50031->50032 50033 40ef60 6 API calls 50031->50033 50034 40863f fread 50031->50034 50035 408670 memcmp 50031->50035 50032->50001 50033->50031 50034->50031 50034->50032 50035->50031 50035->50032 50059 40ef90 50036->50059 50040 40f100 3 API calls 50039->50040 50041 402f01 50040->50041 50069 402df0 50041->50069 50043 402f19 50043->50022 50045 4046bc 50044->50045 50046 408b00 12 API calls 50045->50046 50047 4046e1 50046->50047 50048 408b00 12 API calls 50047->50048 50049 4046fc _wfopen 50048->50049 50049->49998 50050->50002 50051->50002 50052->50002 50053->50002 50057 40f070 fgetpos 50054->50057 50058 40f05f 50057->50058 50058->50031 50060 40efd8 fgetpos 50059->50060 50061 40efac 50059->50061 50064 401ecc 50060->50064 50065 40efec 50060->50065 50062 40f000 fflush _fileno _filelengthi64 50061->50062 50063 40efb1 50061->50063 50066 40efc1 fsetpos 50062->50066 50067 40efb5 50063->50067 50068 40f02a _errno 50063->50068 50064->50005 50064->50006 50065->50062 50065->50066 50066->50064 50067->50066 50068->50064 50070 402dfc 50069->50070 50071 408b00 10 API calls 50070->50071 50072 402e38 50071->50072 50073 402e90 MessageBoxA 50072->50073 50074 402e3c 50072->50074 50073->50043 50075 408b00 10 API calls 50074->50075 50076 402e5e MessageBoxW 50075->50076 50076->50043 50077 4038e1 50081 4038e8 50077->50081 50079 4039e0 50081->50079 50083 403955 PyUnicode_FromString PyObject_SetAttrString Py_DecRef PyMarshal_ReadObjectFromString 50081->50083 50084 4039ed 50081->50084 50110 401980 50081->50110 50115 4019c0 50081->50115 50145 403270 50081->50145 50085 403a09 50083->50085 50086 40399c PyObject_SetAttrString PyEval_EvalCode 50083->50086 50087 402ed0 12 API calls 50084->50087 50091 402ed0 12 API calls 50085->50091 50088 4039d2 free 50086->50088 50089 403a33 PyErr_Fetch PyErr_NormalizeException PyObject_Str PyUnicode_AsUTF8 50086->50089 50090 4039f9 50087->50090 50088->50081 50092 403a89 Py_DecRef 50089->50092 50093 403a7f _strdup 50089->50093 50094 403a1d PyErr_Print 50091->50094 50148 402270 14 API calls 50092->50148 50093->50092 50096 403aa2 50097 403aac _strdup PyErr_Restore PyErr_Print 50096->50097 50098 403b3d PyImport_ImportModule 50096->50098 50149 402ce0 33 API calls 50097->50149 50099 403b68 PyObject_GetAttrString 50098->50099 50100 403c8d Py_DecRef 50098->50100 50102 403c80 Py_DecRef 50099->50102 50103 403b85 PyObject_CallFunctionObjArgs 50099->50103 50106 403c9b 50100->50106 50102->50100 50105 403bb6 9 API calls 50103->50105 50103->50106 50104 403af1 free free 50105->50106 50107 403c51 PyUnicode_AsUTF8 50105->50107 50108 403c6a Py_DecRef Py_DecRef 50106->50108 50107->50108 50109 403c60 _strdup 50107->50109 50108->50102 50109->50108 50111 4019a0 50110->50111 50112 401993 50110->50112 50113 402ed0 12 API calls 50111->50113 50112->50081 50114 4019ac 50113->50114 50114->50081 50116 401b30 50115->50116 50117 4019d9 50115->50117 50118 4046b0 13 API calls 50116->50118 50119 40ef60 6 API calls 50117->50119 50120 401b43 50118->50120 50121 4019fb 50119->50121 50120->50117 50122 401b51 50120->50122 50123 401b70 50121->50123 50124 401a07 malloc 50121->50124 50125 402ed0 12 API calls 50122->50125 50177 403030 14 API calls 50123->50177 50127 401a1e 50124->50127 50128 401b9f 50124->50128 50129 401af0 50125->50129 50132 401b00 50127->50132 50133 401a2c 50127->50133 50178 403030 14 API calls 50128->50178 50129->50081 50130 401b8b 50130->50081 50151 401610 50132->50151 50137 401a73 fread 50133->50137 50138 401a48 50133->50138 50140 401adc 50133->50140 50135 401ae2 fclose 50135->50129 50136 401b14 50139 401ac8 free 50136->50139 50136->50140 50137->50138 50141 401aa5 50137->50141 50138->50133 50138->50137 50142 401b20 50138->50142 50139->50140 50140->50129 50140->50135 50150 403030 14 API calls 50141->50150 50142->50135 50144 401b2a 50142->50144 50144->50129 50146 40f100 3 API calls 50145->50146 50147 403297 50146->50147 50147->50081 50148->50096 50149->50104 50150->50139 50179 40a4f0 50151->50179 50154 401672 malloc 50156 401688 malloc 50154->50156 50157 401919 50154->50157 50155 4018d4 50158 402ed0 12 API calls 50155->50158 50160 4018f9 50156->50160 50169 4016a4 50156->50169 50183 403030 14 API calls 50157->50183 50161 401846 50158->50161 50182 403030 14 API calls 50160->50182 50161->50136 50163 401938 50164 4016d5 fread 50166 401826 50164->50166 50167 401701 ferror 50164->50167 50165 401858 50165->50136 50168 401832 free free 50166->50168 50167->50166 50167->50169 50168->50161 50169->50164 50169->50165 50169->50166 50170 4017e9 50169->50170 50172 401770 fwrite 50169->50172 50175 40187f memcpy 50169->50175 50170->50166 50171 402ed0 12 API calls 50170->50171 50171->50166 50173 4018ca 50172->50173 50174 40179c ferror 50172->50174 50173->50170 50174->50173 50176 4017b0 50174->50176 50175->50169 50176->50169 50177->50130 50178->50140 50184 40a3f0 50179->50184 50181 401668 50181->50154 50181->50155 50182->50166 50183->50163 50185 40a405 50184->50185 50187 40a45c 50184->50187 50186 40a43d malloc 50185->50186 50185->50187 50186->50187 50187->50181 50188 405dc4 50189 405dc8 50188->50189 50190 402ed0 12 API calls 50189->50190 50191 405da4 PyErr_Occurred 50189->50191 50190->50189 50192 405dba free 50191->50192 50193 405dae PyErr_Print PyErr_Clear 50191->50193 50194 405d50 50192->50194 50193->50192 50195 401980 12 API calls 50194->50195 50196 405de0 50194->50196 50197 4019c0 35 API calls 50194->50197 50195->50194 50198 405d7d PyMarshal_ReadObjectFromString 50197->50198 50198->50189 50199 405d93 PyImport_ExecCodeModule 50198->50199 50199->50189 50199->50191 50200 401124 __wgetmainargs 50201 408668 50202 408670 memcmp 50201->50202 50204 4086b2 free 50202->50204 50207 4085d6 50202->50207 50205 40ef60 6 API calls 50205->50207 50206 40863f fread 50206->50204 50206->50207 50207->50202 50207->50204 50207->50205 50207->50206 50208 401b2c 50209 401b30 50208->50209 50210 4046b0 13 API calls 50209->50210 50211 401b43 50210->50211 50212 401b51 50211->50212 50213 4019d9 50211->50213 50214 402ed0 12 API calls 50212->50214 50215 40ef60 6 API calls 50213->50215 50234 401af0 50214->50234 50216 4019fb 50215->50216 50217 401b70 50216->50217 50218 401a07 malloc 50216->50218 50239 403030 14 API calls 50217->50239 50220 401a1e 50218->50220 50221 401b9f 50218->50221 50224 401b00 50220->50224 50225 401a2c 50220->50225 50240 403030 14 API calls 50221->50240 50222 401b8b 50226 401610 24 API calls 50224->50226 50227 401adc 50225->50227 50230 401a73 fread 50225->50230 50231 401a48 50225->50231 50229 401b14 50226->50229 50228 401ae2 fclose 50227->50228 50227->50234 50228->50234 50229->50227 50232 401ac8 free 50229->50232 50230->50231 50233 401aa5 50230->50233 50231->50225 50231->50230 50235 401b20 50231->50235 50232->50227 50238 403030 14 API calls 50233->50238 50235->50228 50237 401b2a 50235->50237 50237->50234 50238->50232 50239->50222 50240->50227 50241 4044f0 50242 4044fb 50241->50242 50243 408b00 12 API calls 50242->50243 50244 40451c _wstat 50243->50244 50245 40a4b1 50246 40a436 malloc 50245->50246 50248 40a45c 50246->50248 50249 4011b3 50250 4011b8 50249->50250 50251 4011c0 Sleep 50250->50251 50256 4011ea 50250->50256 50252 4011cc 50251->50252 50252->50250 50262 4011da 50252->50262 50253 401406 _amsg_exit 50254 401420 _initterm 50253->50254 50253->50256 50254->50256 50255 401478 _initterm 50257 40149b 50255->50257 50256->50253 50256->50254 50256->50255 50256->50262 50260 4014a3 exit 50257->50260 50259 401241 SetUnhandledExceptionFilter 50259->50262 50261 401267 __p__wcmdln 50261->50262 50262->50253 50262->50256 50262->50261 50263 4012eb malloc 50262->50263 50264 4012e6 50262->50264 50275 40db40 12 API calls 50262->50275 50263->50257 50265 401311 50263->50265 50264->50263 50265->50265 50266 401346 malloc memcpy 50265->50266 50266->50265 50267 40136f 50266->50267 50276 40d710 _onexit 50267->50276 50269 401388 50277 40d7a0 378 API calls 50269->50277 50271 4013af 50271->50260 50272 4013c2 50271->50272 50273 4013d0 50272->50273 50274 401462 _cexit 50272->50274 50275->50259 50276->50269 50277->50271 50278 4017f4 50285 4016b1 50278->50285 50279 401770 fwrite 50281 4018ca 50279->50281 50282 40179c ferror 50279->50282 50280 402ed0 12 API calls 50291 401826 50280->50291 50290 4017e9 50281->50290 50282->50281 50284 4017b0 50282->50284 50283 40187f memcpy 50283->50285 50284->50285 50285->50279 50285->50283 50287 4016d5 fread 50285->50287 50288 401858 50285->50288 50285->50290 50285->50291 50286 401832 free free 50289 401846 50286->50289 50287->50291 50292 401701 ferror 50287->50292 50290->50280 50290->50291 50291->50286 50292->50285 50292->50291 50293 4018b6 50294 401826 50293->50294 50295 401832 free free 50294->50295 50296 401846 50295->50296

                                          Executed Functions

                                          Function 0040117C Relevance: 18.2, APIs: 12, Instructions: 206sleepCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 305 40117c-40119a 306 4011a0-4011b1 305->306 307 401451-40145a GetStartupInfoW 305->307 308 4011cc-4011d8 306->308 311 401462-401477 _cexit 307->311 309 4011b8-4011ba 308->309 310 4011da-4011e4 308->310 312 4011c0-4011c9 Sleep 309->312 313 4013f3-401400 309->313 314 401406-40141a _amsg_exit 310->314 315 4011ea-4011f1 310->315 312->308 313->314 313->315 316 401420-401440 _initterm 314->316 317 40120f-401211 314->317 318 4011f7-401209 315->318 319 401478-401491 _initterm 315->319 320 401446-40144c 316->320 321 401217-40121e 316->321 317->320 317->321 318->316 318->317 322 40149b 319->322 320->321 323 401220-401239 321->323 324 40123c-40127c call 40db40 SetUnhandledExceptionFilter call 4173c0 call 40d970 __p__wcmdln 321->324 328 4014a3-4014af exit 322->328 323->324 333 401292-401299 324->333 334 40127e 324->334 335 401280-401283 333->335 336 40129b-4012a7 333->336 337 4012cd-4012d5 334->337 341 401285-401288 335->341 342 4012a9-4012b0 335->342 338 40128f 336->338 339 4012d7-4012e0 337->339 340 4012eb-40130b malloc 337->340 338->333 345 4012e6 339->345 346 4013ea 339->346 340->322 347 401311-40131d 340->347 341->342 348 40128a 341->348 343 4012b2 342->343 344 4012c8 342->344 349 4012b8-4012c6 343->349 344->337 345->340 346->313 350 401320-401326 347->350 348->338 349->344 349->349 351 4013e0-4013e5 350->351 352 40132c-401331 350->352 354 401346-40136d malloc memcpy 351->354 353 401338-401341 352->353 353->353 355 401343 353->355 354->350 356 40136f-4013bc call 40d770 call 40d7a0 354->356 355->354 356->328 361 4013c2-4013ca 356->361 361->311 362 4013d0-4013db 361->362
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__wcmdlnmemcpy
                                          • String ID:
                                          • API String ID: 1204267290-0
                                          • Opcode ID: eac8becde6c0dd191b15aea711b8aa84f0afa324810f6ed2f537ece7752c968d
                                          • Instruction ID: 676354774380156a6d31bcdc11651c5caae96c91ab7a06ee3bbcf8190cbc5d75
                                          • Opcode Fuzzy Hash: eac8becde6c0dd191b15aea711b8aa84f0afa324810f6ed2f537ece7752c968d
                                          • Instruction Fuzzy Hash: BF81AF70A042018FDB24EFA4D98576A77F0FB44304F51453EDA85AB3B1D7789885CB8A
                                          Function 00403880 Relevance: 91.3, APIs: 39, Strings: 13, Instructions: 262COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • PyImport_AddModule.PYTHON310 ref: 004038A1
                                          • PyModule_GetDict.PYTHON310 ref: 004038B4
                                          • PyUnicode_FromString.PYTHON310 ref: 0040395C
                                          • PyObject_SetAttrString.PYTHON310 ref: 00403975
                                          • Py_DecRef.PYTHON310 ref: 00403982
                                          • PyMarshal_ReadObjectFromString.PYTHON310 ref: 00403992
                                          • PyObject_SetAttrString.PYTHON310 ref: 004039AF
                                          • PyEval_EvalCode.PYTHON310 ref: 004039C8
                                          • free.MSVCRT ref: 004039D5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String$AttrFromObject_$CodeDictEvalEval_Import_Marshal_ModuleModule_ObjectReadUnicode_free
                                          • String ID: %s%c%s.py$Absolute path to script exceeds PATH_MAX$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to unmarshal code object for %s$Traceback is disabled via bootloader option.$\$__file__$__main__$_pyi_main_co$format_exception$pyi-disable-windowed-traceback$traceback
                                          • API String ID: 1659846952-4198433784
                                          • Opcode ID: 15c4208f2d8e130932219e82c4b0b5fb2b9fa64d0c384d1944226fe3b7cf001d
                                          • Instruction ID: 6540644356b1fe9e7dd3889ac2da6173512776e99aae4954ed64b62622b12aad
                                          • Opcode Fuzzy Hash: 15c4208f2d8e130932219e82c4b0b5fb2b9fa64d0c384d1944226fe3b7cf001d
                                          • Instruction Fuzzy Hash: 35B1C4B4608701DFC710AF29D58815ABBE4BF88355F41892EE9D9D3390DBB8C981CF5A
                                          Function 00401610 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 186fileCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 49 401610-40166c call 40a4f0 52 401672-401682 malloc 49->52 53 4018d4-4018f4 call 402ed0 49->53 54 401688-40169e malloc 52->54 55 401919-401938 call 403030 52->55 61 401846-401852 53->61 58 4016a4-4016ad 54->58 59 4018f9-401914 call 403030 54->59 64 4016b1-4016cf 58->64 70 401826-401841 call 40c7c0 free * 2 59->70 65 4016d5-4016fb fread 64->65 66 401858-401868 64->66 68 4018c0-4018c5 65->68 69 401701-40170f ferror 65->69 68->70 69->68 71 401715-40171d 69->71 70->61 73 401721-40174a call 40a5c0 71->73 77 401750-401753 73->77 78 4017f8-4017fb 73->78 80 401759-40176a 77->80 81 401806-401821 call 402ed0 77->81 79 401801 78->79 78->80 79->81 83 401870-401879 80->83 84 401770-401796 fwrite 80->84 81->70 87 4017b4-4017b6 83->87 88 40187f-4018b1 memcpy 83->88 85 4018ca-4018cf 84->85 86 40179c-4017aa ferror 84->86 85->81 86->85 89 4017b0 86->89 87->73 90 4017bc-4017dd 87->90 88->87 89->87 90->70 91 4017df-4017e3 90->91 91->64 92 4017e9-4017f0 91->92 92->70 93 4017f2 92->93 93->81
                                          APIs
                                          Strings
                                          • 8, xrefs: 00401620
                                          • Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 0040191D
                                          • malloc, xrefs: 00401908, 00401925
                                          • Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 004018E1
                                          • Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 004018FC
                                          • 1.2.13, xrefs: 00401628
                                          • Failed to extract %s: decompression resulted in return code %d!, xrefs: 00401813
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ferrorfreemalloc$freadfwritememcpy
                                          • String ID: 1.2.13$8$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                          • API String ID: 3882407908-2046485118
                                          • Opcode ID: d25199e72a9c78f064208eb155d88d6c3da84988dbe3a474574327916eacab17
                                          • Instruction ID: 36ffe3033784580453c6a567143783feaca3ec72a60cee7d1f4dfc22211088d5
                                          • Opcode Fuzzy Hash: d25199e72a9c78f064208eb155d88d6c3da84988dbe3a474574327916eacab17
                                          • Instruction Fuzzy Hash: F481D3B56093019FD750EF29C08461BBBE1BF88358F508A2EF4D8973A1E778D985CB46
                                          Function 00401E60 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 165COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 94 401e60-401e6f 95 402020-402039 call 4046b0 94->95 96 401e75-401eb0 call 408550 94->96 95->96 102 40203f-402044 95->102 101 401eb6-401ece call 40ef60 96->101 96->102 106 401ed4-401ef7 fread 101->106 107 40208f-4020a3 call 403030 101->107 104 402014-40201d 102->104 109 402061-40207a call 403030 106->109 110 401efd-401f67 call 40ef60 malloc 106->110 107->102 109->104 116 4020a5-4020bc call 403030 110->116 117 401f6d-401f89 fread 110->117 116->104 119 402046-40205f call 403030 117->119 120 401f8f-401fa6 ferror 117->120 119->104 123 40207c-40208d call 402ed0 120->123 124 401fac-401fb2 120->124 123->104 125 401fb8-401fba 124->125 128 402000-402004 125->128 129 401fbc-401fdf 125->129 128->104 132 402006-40200e fclose 128->132 129->125 131 401fe1-401ff4 call 402ed0 129->131 131->129 135 401ff6-401ffd 131->135 132->104 135->128
                                          APIs
                                            • Part of subcall function 00408550: malloc.MSVCRT ref: 00408562
                                            • Part of subcall function 00408550: fread.MSVCRT ref: 00408656
                                            • Part of subcall function 00408550: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401EAA), ref: 004086BF
                                          • fread.MSVCRT ref: 00401EF0
                                          • malloc.MSVCRT ref: 00401F5D
                                          • fread.MSVCRT ref: 00401F82
                                          • ferror.MSVCRT ref: 00401F9D
                                          • fclose.MSVCRT ref: 00402009
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fread$malloc$fcloseferrorfree
                                          • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$X$fread$fseek$malloc
                                          • API String ID: 938791849-202209224
                                          • Opcode ID: 184307eea2abe11cbc5b19158909a6000e688a56696f3d40b4622786db81104a
                                          • Instruction ID: 48232b83441798ba76066763261cf49e77d2abc7de2ba2fc6216de52d01d1662
                                          • Opcode Fuzzy Hash: 184307eea2abe11cbc5b19158909a6000e688a56696f3d40b4622786db81104a
                                          • Instruction Fuzzy Hash: 40616EB0905301CFCB04DF25C58865ABBE1BF88314F15C96EE9989B3D6D778D884CB9A
                                          Function 0040E900 Relevance: 27.3, APIs: 18, Instructions: 269COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 136 40e900-40e921 setlocale 137 40e923-40e92b _strdup 136->137 138 40e92d-40e946 setlocale 136->138 137->138 139 40e950-40e9b1 wcstombs realloc wcstombs setlocale free 138->139 140 40e948-40e94e 138->140 142 40e9b7-40e9c0 139->142 140->139 141 40e9c8-40ea1f mbstowcs call 40e630 mbstowcs 140->141 145 40ea60-40ea64 141->145 146 40ea21-40ea32 141->146 149 40ea67-40ea6c 145->149 147 40ec40-40ec44 146->147 148 40ea38-40ea3c 146->148 147->149 150 40ec4a-40ec4f 147->150 148->147 151 40ea42-40ea46 148->151 152 40ea80-40ea89 149->152 153 40ea6e-40ea71 149->153 150->149 154 40ec55-40ec70 setlocale free 150->154 151->149 155 40ea48-40ea56 151->155 156 40eaa4-40eaa8 152->156 153->139 159 40eb66-40eb69 154->159 155->149 157 40ea90-40ea96 156->157 158 40eaaa-40eab1 156->158 162 40ea98-40eaa2 157->162 163 40eabb-40eac2 157->163 160 40eab3-40eab7 158->160 161 40eac4-40eac8 158->161 159->142 165 40eab8 160->165 161->165 166 40eaca-40eacf 161->166 162->156 164 40ead8-40eadb 162->164 163->161 163->165 168 40eb70-40eb78 164->168 169 40eae1-40eae9 164->169 165->163 166->164 167 40ead1-40ead3 166->167 167->162 170 40eccb 168->170 171 40eb7e-40eb85 168->171 172 40eaeb-40eaef 169->172 173 40eafc-40eb49 wcstombs realloc wcstombs 169->173 174 40ecd1-40ecd9 170->174 175 40eb8d-40eb9c 170->175 171->168 176 40eb87-40eb8b 171->176 172->173 177 40eaf1-40eaf9 172->177 178 40eb4e-40eb61 setlocale free 173->178 179 40ece5-40eced 174->179 180 40ecdb-40ecdf 174->180 181 40ebb0-40ebbb 175->181 182 40eb9e-40eba2 175->182 176->168 176->175 177->173 178->159 179->175 183 40ecf3-40ecfb 179->183 180->175 180->179 181->181 186 40ebbd-40ebc1 181->186 184 40ec75-40ec79 182->184 185 40eba8-40ebaf 182->185 183->175 187 40ed01-40ed08 183->187 189 40ebd0 184->189 190 40ec7f-40ec82 184->190 185->181 186->181 188 40ebc3-40ebca 186->188 187->175 188->184 188->189 191 40ebd2-40ebd5 189->191 190->191 192 40ec9b-40ecbc wcstombs 191->192 193 40ebdb-40ebe0 191->193 192->178 195 40ecc2-40ecc6 192->195 194 40ec06-40ec11 193->194 196 40ec13 194->196 197 40ebe8-40ebf3 194->197 195->178 198 40ec16-40ec1a 196->198 199 40ec90-40ec92 197->199 200 40ebf9-40ebfb 197->200 201 40ec28-40ec33 198->201 202 40ec1c-40ec22 198->202 199->198 203 40ebfd-40ec00 200->203 201->201 205 40ec35-40ec39 201->205 202->203 204 40ec24 202->204 203->194 206 40ec98 203->206 204->201 205->201 207 40ec3b 205->207 206->192 207->203
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: setlocale$wcstombs$_strdupfreerealloc
                                          • String ID:
                                          • API String ID: 2293806352-0
                                          • Opcode ID: 24aa9c2407c2a4c3f4ed46904f0d809acaa0fb0afecc03c31603bba52fa15124
                                          • Instruction ID: 614429c9ea5f0c0fbdd7ec2be82af17343d93239b7468d5b99009060838935dd
                                          • Opcode Fuzzy Hash: 24aa9c2407c2a4c3f4ed46904f0d809acaa0fb0afecc03c31603bba52fa15124
                                          • Instruction Fuzzy Hash: 48A161709042158ADB24AF66C0452BBF7F1FF44344F45883FE489A7391E33D9892DB8A
                                          Function 00405CF0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 72stringCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 208 405cf0-405d28 strlen PyUnicode_Decode 209 405dea-405dfb call 402ed0 208->209 210 405d2e-405d45 PySys_SetObject 208->210 218 405de2-405de9 209->218 211 405d63-405d6c 210->211 212 405d47 210->212 216 405d50-405d61 call 401980 211->216 217 405d6e-405d91 call 4019c0 PyMarshal_ReadObjectFromString 211->217 214 405de0 212->214 214->218 216->211 216->214 223 405d93-405da2 PyImport_ExecCodeModule 217->223 224 405dc8-405dd8 call 402ed0 217->224 223->224 225 405da4-405dac PyErr_Occurred 223->225 224->225 227 405dba-405dc2 free 225->227 228 405dae-405db4 PyErr_Print PyErr_Clear 225->228 227->216 228->227
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Err_$Object$ClearCodeDecodeExecFromImport_Marshal_ModuleOccurredPrintReadStringSys_Unicode_freestrlen
                                          • String ID: Failed to get _MEIPASS as PyObject.$Module object for %s is NULL!$_MEIPASS$strict$utf-8
                                          • API String ID: 1645963791-985300917
                                          • Opcode ID: 6a5a0fc19d408c57ccd74b2a843a6cf11713645823d17a702bec6b19c546019a
                                          • Instruction ID: b798077ea826a97b31ed519bc33854408a60d385b89e575b30205180b7c9f22a
                                          • Opcode Fuzzy Hash: 6a5a0fc19d408c57ccd74b2a843a6cf11713645823d17a702bec6b19c546019a
                                          • Instruction Fuzzy Hash: 692117B0219B009BC7207F25D98856BBBE4FE80750F45892FE4C997291D7789482DF6B
                                          Function 004019C0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 141COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 230 4019c0-4019d3 231 401b30-401b4b call 4046b0 230->231 232 4019d9-401a01 call 40ef60 230->232 231->232 237 401b51-401b68 call 402ed0 231->237 238 401b70-401b9e call 403030 232->238 239 401a07-401a18 malloc 232->239 249 401af0-401afb 237->249 242 401a1e-401a26 239->242 243 401b9f-401bc2 call 403030 239->243 247 401b00-401b16 call 401610 242->247 248 401a2c-401a32 242->248 253 401adc-401ae0 243->253 259 401ac8-401ad4 free 247->259 260 401b18-401b1c 247->260 252 401a38-401a40 248->252 248->253 254 401a58-401a6a 252->254 253->249 255 401ae2-401aea fclose 253->255 257 401a73-401aa3 fread 254->257 258 401a6c-401a71 254->258 255->249 261 401aa5-401ac3 call 403030 257->261 262 401a48-401a52 257->262 258->257 259->253 260->255 263 401b1e 260->263 261->259 262->254 264 401b20-401b28 262->264 263->249 264->255 266 401b2a 264->266 266->249
                                          APIs
                                          • malloc.MSVCRT ref: 00401A0D
                                          • fread.MSVCRT ref: 00401A94
                                          • free.MSVCRT(?,?,?,?,0040638C,?,?,?,?,?,?,?,?,00000000,?,004040A4), ref: 00401ACF
                                          • fclose.MSVCRT ref: 00401AE5
                                          Strings
                                          • Failed to extract %s: failed to read data chunk!, xrefs: 00401AAD
                                          • fseek, xrefs: 00401B7F
                                          • malloc, xrefs: 00401BB2
                                          • Failed to extract %s: failed to open archive file!, xrefs: 00401B55
                                          • fread, xrefs: 00401AB5
                                          • Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00401BA7
                                          • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401B73
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclosefreadfreemalloc
                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                          • API String ID: 3295367466-3659356012
                                          • Opcode ID: 8884fdb84953ef4ecbf5526515473dd84cde1690139ba998021ef6e9a9ea1245
                                          • Instruction ID: c4bf1cbcbd5ed2c421977dfe96b942ab9f05e938e4513c73373e5f6d25da3068
                                          • Opcode Fuzzy Hash: 8884fdb84953ef4ecbf5526515473dd84cde1690139ba998021ef6e9a9ea1245
                                          • Instruction Fuzzy Hash: A25103B16093019FD700EF2AD49461BBBE4AF85744F05882EF988DB351E779D885CF8A
                                          Function 004038E1 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 59COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • PyUnicode_FromString.PYTHON310 ref: 0040395C
                                          • PyObject_SetAttrString.PYTHON310 ref: 00403975
                                          • Py_DecRef.PYTHON310 ref: 00403982
                                          • PyMarshal_ReadObjectFromString.PYTHON310 ref: 00403992
                                          • PyObject_SetAttrString.PYTHON310 ref: 004039AF
                                          • PyEval_EvalCode.PYTHON310 ref: 004039C8
                                          • free.MSVCRT ref: 004039D5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String$AttrFromObject_$CodeEvalEval_Marshal_ObjectReadUnicode_free
                                          • String ID: %s%c%s.py$\$__file__$_pyi_main_co
                                          • API String ID: 3638413197-1862493962
                                          • Opcode ID: 46cf789b736286b4a61b83edaca85d21ba6631443c1c9059bb822cdedcba4429
                                          • Instruction ID: c970f6cc1162f0d106d27565064d24bae80cc5d647643b18d1f9b1af61abd66d
                                          • Opcode Fuzzy Hash: 46cf789b736286b4a61b83edaca85d21ba6631443c1c9059bb822cdedcba4429
                                          • Instruction Fuzzy Hash: 58219BB4909701EFC710AF24C18865ABFE4BF88745F41892EE8C993350E7B8D985DF4A
                                          Function 00405DC4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 363 405dc4 364 405dc8-405dd8 call 402ed0 363->364 367 405da4-405dac PyErr_Occurred 364->367 368 405dba-405dc2 free 367->368 369 405dae-405db4 PyErr_Print PyErr_Clear 367->369 370 405d50-405d61 call 401980 368->370 369->368 373 405de0-405de9 370->373 374 405d63-405d6c 370->374 374->370 376 405d6e-405d91 call 4019c0 PyMarshal_ReadObjectFromString 374->376 376->364 379 405d93-405da2 PyImport_ExecCodeModule 376->379 379->364 379->367
                                          APIs
                                          Strings
                                          • Module object for %s is NULL!, xrefs: 00405DCC
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Err_$ClearCodeExecFromImport_Marshal_ModuleObjectOccurredPrintReadStringfree
                                          • String ID: Module object for %s is NULL!
                                          • API String ID: 2954924069-1939177074
                                          • Opcode ID: 7f3ff4246443669002559e413b6afe45e893b7647b27d817c239185db9502501
                                          • Instruction ID: 5b8f683c50dc34ce5f11ffbd1f02edeffe67dd040c89a12bc9db49ded73bce97
                                          • Opcode Fuzzy Hash: 7f3ff4246443669002559e413b6afe45e893b7647b27d817c239185db9502501
                                          • Instruction Fuzzy Hash: 3A01D3B0609B00DBC7206F25D54926BBBE1EE44740F45882FE489D6291DB788882DF5A
                                          Function 0040EF90 Relevance: 9.1, APIs: 6, Instructions: 54COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 380 40ef90-40efaa 381 40efd8-40efea fgetpos 380->381 382 40efac-40efaf 380->382 385 40f03c-40f041 381->385 386 40efec-40eff4 381->386 383 40f000-40f028 fflush _fileno _filelengthi64 382->383 384 40efb1-40efb3 382->384 388 40efc1-40efc8 fsetpos 383->388 389 40efb5-40efbd 384->389 390 40f02a-40f03a _errno 384->390 387 40efcd-40efd4 385->387 386->383 386->388 388->387 389->388 390->387
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _errno_filelengthi64_filenofflushfgetposfsetpos
                                          • String ID:
                                          • API String ID: 4183758535-0
                                          • Opcode ID: 0e874d7c1527097df73717f8d8dd802be641f195fc25bc8155d28149c3b9a275
                                          • Instruction ID: 4b13233adec89eef7c79cf0ca00fcee1fa5ec0274880c3d786e8fbaf61c832b7
                                          • Opcode Fuzzy Hash: 0e874d7c1527097df73717f8d8dd802be641f195fc25bc8155d28149c3b9a275
                                          • Instruction Fuzzy Hash: 7A113DB15087059BC310AF2A958105FBBE4EF91354F120D3FF89493292E239D999CB96
                                          Function 00405D4C Relevance: 9.0, APIs: 6, Instructions: 35COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 391 405d4c 392 405d50-405d61 call 401980 391->392 395 405de0-405de9 392->395 396 405d63-405d6c 392->396 396->392 398 405d6e-405d91 call 4019c0 PyMarshal_ReadObjectFromString 396->398 401 405d93-405da2 PyImport_ExecCodeModule 398->401 402 405dc8-405dd8 call 402ed0 398->402 401->402 403 405da4-405dac PyErr_Occurred 401->403 402->403 405 405dba-405dc2 free 403->405 406 405dae-405db4 PyErr_Print PyErr_Clear 403->406 405->392 406->405
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Err_$ClearCodeExecFromImport_Marshal_ModuleObjectOccurredPrintReadStringfree
                                          • String ID:
                                          • API String ID: 2954924069-0
                                          • Opcode ID: adc5dfaa51ca1f11fe256012238351c5b7b9446f2bef57875ae31e97d593283a
                                          • Instruction ID: cbea3933326be5ba74a4cecacd0323492524317ff469b2c4e41e1fb4f155b449
                                          • Opcode Fuzzy Hash: adc5dfaa51ca1f11fe256012238351c5b7b9446f2bef57875ae31e97d593283a
                                          • Instruction Fuzzy Hash: E901D6B0605B01DFC7206F25994822BBBE1EE44740B45883FE999D7291DB78C842DF5A
                                          Function 00408550 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 408 408550-40856b malloc 409 408571-40858f call 40ef60 408->409 410 4086b8-4086ba 408->410 409->410 414 408595-4085b8 call 40f050 409->414 412 4086bc-4086cf free 410->412 414->410 417 4085be-4085d2 414->417 418 4085d6-4085ec 417->418 419 4085fe-40861d 418->419 420 4085ee-4085f6 418->420 421 4086b2-4086b4 419->421 422 408623-40863d call 40ef60 419->422 420->419 421->410 422->421 425 40863f-40865d fread 422->425 425->421 426 40865f-408666 425->426 427 408690-408692 426->427 428 408670-40868c memcmp 427->428 429 408694-4086ac 427->429 430 4086d0-4086e6 428->430 431 40868e 428->431 429->418 429->421 430->412 431->427
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: freadfreemalloc
                                          • String ID:
                                          • API String ID: 2848089211-0
                                          • Opcode ID: 1a9925d51e5002b52557f3f82c440e3fe1630ff818de9e7bab4658c492a1da82
                                          • Instruction ID: cab96f3465d474487508a1ec879676b61213e1df38a8e45f68965f676f42926a
                                          • Opcode Fuzzy Hash: 1a9925d51e5002b52557f3f82c440e3fe1630ff818de9e7bab4658c492a1da82
                                          • Instruction Fuzzy Hash: 78413B716083118BC710DF29C58060FFBE1AFC8354F168E2EF9D897391EA79D8498B86
                                          Function 0040EFF6 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 432 40eff6-40effd 433 40f000-40f028 fsetpos fflush _fileno _filelengthi64 432->433 435 40efcd-40efd4 433->435
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _filelengthi64_filenofflushfsetpos
                                          • String ID:
                                          • API String ID: 1406207278-0
                                          • Opcode ID: 1ed6eb79ae09dcc32bdfa7ab410ec694ef2291df6c0a71ee54ab17ab7ac6ca82
                                          • Instruction ID: 1330b5d8d42a305a2191b976321c9ddfa34460ad39984d8d2968ac2a071300d9
                                          • Opcode Fuzzy Hash: 1ed6eb79ae09dcc32bdfa7ab410ec694ef2291df6c0a71ee54ab17ab7ac6ca82
                                          • Instruction Fuzzy Hash: 5BE0EDB2908B158BC700BF66A88119DFBE0FF80358F134C2FE4D953212E638A5D58B86
                                          Function 004017F4 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 26fileCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 436 4017f4 437 4017f8-4017fb 436->437 438 401801 437->438 439 401759-40176a 437->439 440 401806-401821 call 402ed0 438->440 441 401870-401879 439->441 442 401770-401796 fwrite 439->442 448 401826-401841 call 40c7c0 free * 2 440->448 446 4017b4-4017b6 441->446 447 40187f-4018b1 memcpy 441->447 444 4018ca-4018cf 442->444 445 40179c-4017aa ferror 442->445 444->440 445->444 449 4017b0 445->449 450 401721-40174a call 40a5c0 446->450 451 4017bc-4017dd 446->451 447->446 462 401846-401852 448->462 449->446 450->437 461 401750-401753 450->461 451->448 454 4017df-4017e3 451->454 457 4016b1-4016cf 454->457 458 4017e9-4017f0 454->458 459 4016d5-4016fb fread 457->459 460 401858-401868 457->460 458->448 463 4017f2 458->463 464 4018c0-4018c5 459->464 465 401701-40170f ferror 459->465 461->439 461->440 463->440 464->448 465->464 466 401715-40171d 465->466 466->450
                                          APIs
                                          Strings
                                          • Failed to extract %s: decompression resulted in return code %d!, xrefs: 00401813
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$ferrorfwrite
                                          • String ID: Failed to extract %s: decompression resulted in return code %d!
                                          • API String ID: 2451956730-2259475180
                                          • Opcode ID: 830b903f36b84025c492a9392f2ebfc8541cf9aaa14fb670190ebe148b401e78
                                          • Instruction ID: 3822a968a1abd095370c554b2ca83eb16347efd21d9f73064333f8d65a1dff39
                                          • Opcode Fuzzy Hash: 830b903f36b84025c492a9392f2ebfc8541cf9aaa14fb670190ebe148b401e78
                                          • Instruction Fuzzy Hash: 5AF01CB56097008BC710BF29E48105EBBE1FF81324F528A2EF5E897381D739D8818B86
                                          Function 004044F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 467 4044f0-40453c call 40e630 call 408b00 _wstat
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • _wstat.MSVCRT ref: 00404527
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide_wstat
                                          • String ID: vW@
                                          • API String ID: 35547977-739985395
                                          • Opcode ID: f68f487c7fc98f073bf5515ade25dc7e50f262739ba4e39397ed4c0b26112309
                                          • Instruction ID: a5fa3471d1d6b00994ce1f6807dd4af604ac1712bdf86b7583ceec80064c9dbb
                                          • Opcode Fuzzy Hash: f68f487c7fc98f073bf5515ade25dc7e50f262739ba4e39397ed4c0b26112309
                                          • Instruction Fuzzy Hash: 79E0E5B08093009BC700EF7AC58925ABBE4BB88384F808C2DB488C3291E7398548CB52
                                          Function 00401124 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: __wgetmainargs
                                          • String ID: B
                                          • API String ID: 1709950718-3394935788
                                          • Opcode ID: 41afb40690170ecdc9a50beea52290fec0f59d8749ba09f0fc9408188c674ce4
                                          • Instruction ID: 27c32f95ce735926b30c16c90320b224d17bcd53438576fbaefc61be872f07d1
                                          • Opcode Fuzzy Hash: 41afb40690170ecdc9a50beea52290fec0f59d8749ba09f0fc9408188c674ce4
                                          • Instruction Fuzzy Hash: 81E092B1A04711EFC714DF25E645246BBE0BB48308F81D91EE69897210D3B9A549DF8A
                                          Function 0040A3F0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc
                                          • String ID: 8
                                          • API String ID: 2803490479-4194326291
                                          • Opcode ID: 88865b5b26300d2bd4c71fb6e3d37b9dfb2c71bd695db075464367e8e3ddd3a1
                                          • Instruction ID: 3d9a3cba30c8a6cce76611aecb6f7ccedd9577938697bd5609853f48fc3db6fb
                                          • Opcode Fuzzy Hash: 88865b5b26300d2bd4c71fb6e3d37b9dfb2c71bd695db075464367e8e3ddd3a1
                                          • Instruction Fuzzy Hash: 542159B45083018FDB10DF29C5886267BE0AF48314F51866EA8499B3C5E3B8CC65CF47
                                          Function 00408100 Relevance: 3.0, APIs: 2, Instructions: 22libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • LoadLibraryExW.KERNEL32 ref: 00408136
                                          • free.MSVCRT(?,?,?,?,?,00000000), ref: 00408144
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharLibraryLoadMultiWidefree
                                          • String ID:
                                          • API String ID: 3231889924-0
                                          • Opcode ID: 5d8565fb56928c0b2a339ae78370c30edaeabbfce472f749a9e73ddc86dce43c
                                          • Instruction ID: 9c98291bb8aeede50614ca81ae0f1542a833f490e58002a57af99077e474df99
                                          • Opcode Fuzzy Hash: 5d8565fb56928c0b2a339ae78370c30edaeabbfce472f749a9e73ddc86dce43c
                                          • Instruction Fuzzy Hash: 72E0E5F19093009BDB00BF78E58934BBEE0AB44344F02892DE4C88B341E67988448B82
                                          Function 004018B6 Relevance: 2.5, APIs: 2, Instructions: 19COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID:
                                          • API String ID: 1294909896-0
                                          • Opcode ID: ef69f32362a42e0ce2ffe8284a07d848220a277b661e213d5c3d7f37b51e11aa
                                          • Instruction ID: 37d18b623566974bb2935c6215979c875cfe96a297bc96d00919041d074b5ac9
                                          • Opcode Fuzzy Hash: ef69f32362a42e0ce2ffe8284a07d848220a277b661e213d5c3d7f37b51e11aa
                                          • Instruction Fuzzy Hash: 80E0E6B6604715CBCB107F65F48119DF7E0FF41328F124A3FE9E493291D639A5454B86
                                          Function 004046B0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • _wfopen.MSVCRT ref: 00404703
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide_wfopen
                                          • String ID:
                                          • API String ID: 372205238-0
                                          • Opcode ID: 13c07e3d3bc0b19f75017dbdb54b07b75c5c7dcab1f4d19b5ddeb740e7124e77
                                          • Instruction ID: 3468f0b4211825adde8639be08c033172f5b0e4316271c3a96c81e3ef559f4c6
                                          • Opcode Fuzzy Hash: 13c07e3d3bc0b19f75017dbdb54b07b75c5c7dcab1f4d19b5ddeb740e7124e77
                                          • Instruction Fuzzy Hash: 2FF0F2B04193009FC314FF28D58868EBBE8FF88348F018C2EF5C897252D6789549CB92
                                          Function 0040A4B1 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2577097701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000006.00000002.2577008111.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577215221.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577265533.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577587821.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000006.00000002.2577677392.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc
                                          • String ID:
                                          • API String ID: 2803490479-0
                                          • Opcode ID: e2173ce04817a78d231aa9074b1aa79180b14f8ea2ab174e27efc7c36e8625ac
                                          • Instruction ID: 34294cd6affbb3e785c4932bfc48d0f633533baf833ca0b38d678e79e0ec05fd
                                          • Opcode Fuzzy Hash: e2173ce04817a78d231aa9074b1aa79180b14f8ea2ab174e27efc7c36e8625ac
                                          • Instruction Fuzzy Hash: 87011EB45053018FDB54DF19C184356BBE0FF88304F55896EE8889B385D3B8C855CF46

                                          Non-executed Functions

                                          Function 6A6B8920 Relevance: 77.3, APIs: 39, Strings: 5, Instructions: 271windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?hashLength@QCryptographicHash@@SAHW4Algorithm@1@@Z.QT5CORE(?), ref: 6A6B892C
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A6B896F
                                          • ?warning@QMessageLogger@@QBE?AVQDebug@@XZ.QT5CORE(?), ref: 6A6B897C
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE(Derived key too long:), ref: 6A6B898F
                                          • ?qt_QMetaEnum_debugOperator@@YA?AVQDebug@@AAV1@HPBUQMetaObject@@PBD@Z.QT5CORE(?,?,?,Algorithm), ref: 6A6B89B4
                                          • ??1QDebug@@QAE@XZ.QT5CORE ref: 6A6B89C7
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE( was chosen which produces output of length ), ref: 6A6B89D2
                                          • ??6QDebug@@QAEAAV0@_K@Z.QT5CORE(00000000), ref: 6A6B89DC
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE( but ), ref: 6A6B89E9
                                          • ??6QDebug@@QAEAAV0@_K@Z.QT5CORE(?,?), ref: 6A6B89F7
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE( was requested.), ref: 6A6B8A04
                                          • ??1QDebug@@QAE@XZ.QT5CORE ref: 6A6B8A0E
                                          • ??1QDebug@@QAE@XZ.QT5CORE ref: 6A6B8A14
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6B8A1A
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6B8A40
                                          • ??0QMessageAuthenticationCode@@QAE@W4Algorithm@QCryptographicHash@@ABVQByteArray@@@Z.QT5CORE(?,?), ref: 6A6B8A58
                                          • ??0QByteArray@@QAE@HW4Initialization@Qt@@@Z.QT5CORE(00000004,00000000), ref: 6A6B8A66
                                          • ?addData@QMessageAuthenticationCode@@QAEXABVQByteArray@@@Z.QT5CORE(?), ref: 6A6B8AA8
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE ref: 6A6B8AAE
                                          • ?addData@QMessageAuthenticationCode@@QAEXABVQByteArray@@@Z.QT5CORE(?), ref: 6A6B8AC3
                                          • ?result@QMessageAuthenticationCode@@QBE?AVQByteArray@@XZ.QT5CORE(?), ref: 6A6B8ACE
                                          • ?reset@QMessageAuthenticationCode@@QAEXXZ.QT5CORE ref: 6A6B8AD4
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A6B8ADF
                                          • ?addData@QMessageAuthenticationCode@@QAEXABVQByteArray@@@Z.QT5CORE(?), ref: 6A6B8B00
                                          • ?result@QMessageAuthenticationCode@@QBE?AVQByteArray@@XZ.QT5CORE(?), ref: 6A6B8B0B
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A6B8B12
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6B8B1C
                                          • ?reset@QMessageAuthenticationCode@@QAEXXZ.QT5CORE ref: 6A6B8B26
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE ref: 6A6B8B2C
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A6B8B38
                                          • ?cend@QByteArray@@QBEPBDXZ.QT5CORE ref: 6A6B8B44
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A6B8B50
                                          • ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(?), ref: 6A6B8C21
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6B8C30
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6B8C3A
                                          • ?left@QByteArray@@QBE?AV1@H@Z.QT5CORE(?,?), ref: 6A6B8C6C
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6B8C76
                                          • ??1QMessageAuthenticationCode@@QAE@XZ.QT5CORE ref: 6A6B8C80
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6B8C8A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$Array@@$Debug@@Message$AuthenticationCode@@$Array@@@String@@$?addData@$?begin@?data@?reset@?result@Char@@CryptographicHash@@Logger@@MetaV0@@V0@_$?append@?cend@?hash?left@?qt_?warning@Algorithm@Algorithm@1@@DateEnum_debugInitialization@Length@Object@@Operator@@Qt@@@Time@@V0@$$V1@@
                                          • String ID: but $ was chosen which produces output of length $ was requested.$Algorithm$Derived key too long:
                                          • API String ID: 804143477-3478960887
                                          • Opcode ID: 1b4b9ceba5a3736de4c54b3a765ea750a76663e54ffce406d0d2d2af990d0522
                                          • Instruction ID: 8360bd34a5376eed1d4a2a64e509bb66ebb73459221c714df866f719d74cf8a4
                                          • Opcode Fuzzy Hash: 1b4b9ceba5a3736de4c54b3a765ea750a76663e54ffce406d0d2d2af990d0522
                                          • Instruction Fuzzy Hash: 70B159B25083468FCB04DF65C8989AABBF4FF99245F01492DE587D3261EF30E949CB52
                                          Function 6A690850 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 89windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A69086C
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QLocalServer::listen() called when already listening), ref: 6A690878
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE ref: 6A6908AE
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,%1: Name error,00000000,000000FF), ref: 6A6908C7
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(00000020), ref: 6A6908D9
                                          • ?arg@QString@@QBE?AV1@ABV1@HVQChar@@@Z.QT5CORE(?,00000020,00000000), ref: 6A6908EF
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A6908F9
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A690903
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A69090D
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A690917
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Char@@@Latin1Logger@@Message$?arg@?tr@?warning@Char@@DateMetaObject@@String@@@Time@@V0@$$V0@@
                                          • String ID: $%1: Name error$QLocalServer::listen$QLocalServer::listen() called when already listening
                                          • API String ID: 4161340211-1818592207
                                          • Opcode ID: e24a0b8092fa91a8f95fcfe6ea120aad72c11b80b8d8ca6d5a825b01a4ca58e9
                                          • Instruction ID: 4313ca7d4d5da0e40d63735febf7dc64b57b7412e20802535a2adf20b891d9cf
                                          • Opcode Fuzzy Hash: e24a0b8092fa91a8f95fcfe6ea120aad72c11b80b8d8ca6d5a825b01a4ca58e9
                                          • Instruction Fuzzy Hash: 43319FB2200211ABDB04DB55D959FDABBF4FF99326F01402AF606D2181DF34BD19CBA2
                                          Function 6A684A30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QHostAddress@@QAE@W4SpecialAddress@0@@Z.QT5NETWORK(00000004,?), ref: 6A684A46
                                            • Part of subcall function 6A669D80: ??0QMutex@@QAE@XZ.QT5CORE ref: 6A669D92
                                            • Part of subcall function 6A669D80: ??0QString@@QAE@XZ.QT5CORE ref: 6A669D9B
                                            • Part of subcall function 6A669D80: ?setAddress@QHostAddress@@QAEXW4SpecialAddress@1@@Z.QT5NETWORK(?), ref: 6A669DBE
                                            • Part of subcall function 6A6841C0: ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK(?,?,?,6A684A5D,?,00000000,?,?), ref: 6A6841CB
                                            • Part of subcall function 6A6841C0: ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK(?,?,?,6A684A5D,?,00000000,?,?), ref: 6A6841DD
                                            • Part of subcall function 6A6841C0: ?toString@QHostAddress@@QBE?AVQString@@XZ.QT5NETWORK(?,?,?,?,?,6A684A5D,?,00000000,?,?), ref: 6A684202
                                            • Part of subcall function 6A6841C0: ??1QString@@QAE@XZ.QT5CORE(00000000,?,?,?,?,?,6A684A5D,?,00000000,?,?), ref: 6A684213
                                            • Part of subcall function 6A6841C0: ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK(?,?,6A684A5D,?,00000000,?,?), ref: 6A68421B
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK(?,00000000,?,?), ref: 6A684A63
                                            • Part of subcall function 6A669E10: ??1QString@@QAE@XZ.QT5CORE(00000000,6A6ABD95,?), ref: 6A669E29
                                          • ?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ.QT5NETWORK(?,00000000,?,?), ref: 6A684A72
                                          • ?bind@QAbstractSocket@@QAE_NGV?$QFlags@W4BindFlag@QAbstractSocket@@@@@Z.QT5NETWORK(00000000,?,?,00000000,?,?), ref: 6A684A88
                                            • Part of subcall function 6A6807E0: ??0QHostAddress@@QAE@W4SpecialAddress@0@@Z.QT5NETWORK(00000004), ref: 6A6807EB
                                            • Part of subcall function 6A6807E0: ??1QHostAddress@@QAE@XZ.QT5NETWORK ref: 6A68080D
                                          • ??0QHostAddress@@QAE@XZ.QT5NETWORK(?,00000000,?,?), ref: 6A684A9C
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,?,00000000,?,?), ref: 6A684AA9
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK(?,?,?,?), ref: 6A684AF2
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK(?,?,?,?), ref: 6A684AFB
                                          • ?bytesWritten@QIODevice@@QAEX_J@Z.QT5CORE(00000000,?,?,?,?,?), ref: 6A684B21
                                          • ??1QString@@QAE@XZ.QT5CORE(00000016,?,?,?,?,?,?), ref: 6A684B69
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Unable to send a datagram,00000000,?,?,?,?,?), ref: 6A684B51
                                            • Part of subcall function 6A682AE0: ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?,?,?), ref: 6A682AF9
                                            • Part of subcall function 6A682AE0: ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE ref: 6A682B20
                                          • ??1QString@@QAE@XZ.QT5CORE(00000000,00000000,?,?,?,?,?), ref: 6A684BA8
                                          Strings
                                          • Unable to send a datagram, xrefs: 6A684B42
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Address@@Host$String@@$Abstract$Socket@@$?protocol@LayerNetworkObject@@Protocol@Special$Address@0@@MetaV0@@$?activate@?bind@?bytes?set?state@?tr@Address@Address@1@@Authenticator@@BindDevice@@Flag@Flags@Mutex@@SharedSocketSocket@@@@@State@1@String@Written@
                                          • String ID: Unable to send a datagram
                                          • API String ID: 2186292501-19043489
                                          • Opcode ID: 0d3895cacd8fdd99eb5142c0bd7bb3eccce175b32d91e7dd5ff9c1e7a0fae0a4
                                          • Instruction ID: c0d860e5ca2976084b0a0b4e31ec9d99010ae80a5c0e8482936f449b506e689f
                                          • Opcode Fuzzy Hash: 0d3895cacd8fdd99eb5142c0bd7bb3eccce175b32d91e7dd5ff9c1e7a0fae0a4
                                          • Instruction Fuzzy Hash: D441A0B52083049BC714DF24CC88B9FBBF9EF86668F010629F95683291DF31A909C766
                                          Function 6A69AB60 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 87windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A69AB92
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A69ABAE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket::connectToHostEncrypted: TLS initialization failed), ref: 6A69ABBA
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,TLS initialization failed,00000000,000000FF), ref: 6A69ABD6
                                          • ??1QString@@QAE@XZ.QT5CORE(00000014,?), ref: 6A69ABEE
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A69AC47
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A69AC63
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket::connectToHostEncrypted() called when already connecting/connected), ref: 6A69AC6F
                                          Strings
                                          • QSslSocket::connectToHostEncrypted:, xrefs: 6A69ABFC
                                          • QSslSocket::connectToHostEncrypted() called when already connecting/connected, xrefs: 6A69AC69
                                          • TLS initialization failed, xrefs: 6A69ABC7
                                          • QSslSocket::connectToHostEncrypted: TLS initialization failed, xrefs: 6A69ABB4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$Category@@Logging$?warning@Enabled@H00@String@@Warning$?tr@Init_thread_footerMetaObject@@
                                          • String ID: QSslSocket::connectToHostEncrypted() called when already connecting/connected$QSslSocket::connectToHostEncrypted:$QSslSocket::connectToHostEncrypted: TLS initialization failed$TLS initialization failed
                                          • API String ID: 1589389015-3286642963
                                          • Opcode ID: e04eb694ceb6848a329e9247db26966407ce788f6a3c116aeb9c5b596e40beb8
                                          • Instruction ID: 1cadcee101a0906916bae09fea940f97828287cb70de0bf6c6c4e8d04f3921ad
                                          • Opcode Fuzzy Hash: e04eb694ceb6848a329e9247db26966407ce788f6a3c116aeb9c5b596e40beb8
                                          • Instruction Fuzzy Hash: 7521E675200201ABCF00ABA5CC08F9EBFF5AF85348F024419F55AAB2A2DF71A555C769
                                          Function 6A6B23B0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 86encryptionCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CertOpenSystemStoreW.CRYPT32(00000000,ROOT), ref: 6A6B23D5
                                          • CertFindCertificateInStore.CRYPT32(00000000,00000001,00000000,00000000,00000000,00000000), ref: 6A6B23F8
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(?,?,?,?,?), ref: 6A6B240E
                                          • ??0QSslCertificate@@QAE@ABVQByteArray@@W4EncodingFormat@QSsl@@@Z.QT5NETWORK(?,00000001,?,?,?), ref: 6A6B241F
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?,7FFFFFFF,00000001,?,00000001,?,?,?), ref: 6A6B2446
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?,?,00000001,?,?,?), ref: 6A6B2456
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?,?,00000001,?,?,?), ref: 6A6B245D
                                          • ??1QSslCertificate@@QAE@XZ.QT5NETWORK(?,?,?), ref: 6A6B246F
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?), ref: 6A6B2478
                                          • CertFindCertificateInStore.CRYPT32(00000000,00000001,00000000,00000000,00000000,00000000), ref: 6A6B2488
                                          • CertCloseStore.CRYPT32(00000000,00000000), ref: 6A6B2497
                                            • Part of subcall function 6A6AF840: ?lock@QMutex@@QAEXXZ.QT5CORE(?,?,?,?,6A6B23C1,?), ref: 6A6AF857
                                            • Part of subcall function 6A6AF840: ?setDefaultCiphers@QSslSocket@@SAXABV?$QList@VQSslCipher@@@@@Z.QT5NETWORK(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?,?,?,6A6B23C1), ref: 6A6AF8C6
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: CertCertificate@@Store$Array@@Byte$CertificateFindV0@@$?append@?lock@?setCipher@@@@@Ciphers@CloseData@@DefaultEncodingFormat@ListList@Mutex@@OpenSocket@@Ssl@@@System
                                          • String ID: ROOT
                                          • API String ID: 3261722766-543233263
                                          • Opcode ID: bec68127cfd2383f69441dbae45509ddc9c4841fd480c2e9e1baeec533ce6eb9
                                          • Instruction ID: 0e51ff4381145b1f409e6f0f7a8253a9c091a2ab05cd76e1eaa598c48978c40f
                                          • Opcode Fuzzy Hash: bec68127cfd2383f69441dbae45509ddc9c4841fd480c2e9e1baeec533ce6eb9
                                          • Instruction Fuzzy Hash: 60219072340302ABDB10DFA5DC95F9AB7E8AF44B14F020518F662A71D1DF70EC08876A
                                          Function 6A69AA40 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 85windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A69AA72
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A69AA8E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket::connectToHostEncrypted: TLS initialization failed), ref: 6A69AA9A
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,TLS initialization failed,00000000,000000FF), ref: 6A69AAB6
                                          • ??1QString@@QAE@XZ.QT5CORE(00000014,?), ref: 6A69AACE
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE ref: 6A69AAFB
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A69AB27
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A69AB43
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket::connectToHostEncrypted() called when already connecting/connected), ref: 6A69AB4F
                                          Strings
                                          • QSslSocket::connectToHostEncrypted() called when already connecting/connected, xrefs: 6A69AB49
                                          • TLS initialization failed, xrefs: 6A69AAA7
                                          • QSslSocket::connectToHostEncrypted: TLS initialization failed, xrefs: 6A69AA94
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$Category@@LoggingString@@$?warning@Enabled@H00@Warning$?tr@Init_thread_footerMetaObject@@V0@@
                                          • String ID: QSslSocket::connectToHostEncrypted() called when already connecting/connected$QSslSocket::connectToHostEncrypted: TLS initialization failed$TLS initialization failed
                                          • API String ID: 3292505658-3011372252
                                          • Opcode ID: e26246bda7469eb8e09349c085fb368b5f67da990bf41b4efad36f3ca4e5a930
                                          • Instruction ID: 73ae792373866e421e7d77ac94fbfec715e90d0eaad5d55d7d5a60132bea2d7b
                                          • Opcode Fuzzy Hash: e26246bda7469eb8e09349c085fb368b5f67da990bf41b4efad36f3ca4e5a930
                                          • Instruction Fuzzy Hash: 4621E175200201ABCF00ABA4CC08F9A7FF5AF85318F064419F65A972B2CF71A915CB76
                                          Function 6A68EA90 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 229networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WSARecvFrom.WS2_32(?,?,00000001,00000001,0000001C,?,00000001,00000000,00000000), ref: 6A68EB89
                                          • WSAGetLastError.WS2_32 ref: 6A68EB9B
                                          • ?clear@QHostAddress@@QAEXXZ.QT5NETWORK(00000007,0000001A), ref: 6A68EC02
                                          • ?clear@QHostAddress@@QAEXXZ.QT5NETWORK(00000007,0000001A), ref: 6A68EC0A
                                          • ?setAddress@QHostAddress@@QAEXPBE@Z.QT5NETWORK(?), ref: 6A68ECAB
                                          • ?number@QString@@SA?AV1@IH@Z.QT5CORE(?,?,0000000A,?), ref: 6A68ECC4
                                          • ?setScopeId@QHostAddress@@QAEXABVQString@@@Z.QT5NETWORK(00000000,?), ref: 6A68ECD1
                                          • ??1QString@@QAE@XZ.QT5CORE(00000000,?), ref: 6A68ECDA
                                          • WSANtohl.WS2_32(?,?,?), ref: 6A68ED00
                                          • ?setAddress@QHostAddress@@QAEXI@Z.QT5NETWORK(?), ref: 6A68ED0D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Address@@Host$?set$?clear@Address@String@@$?number@ErrorFromLastNtohlRecvScopeString@@@
                                          • String ID: 0
                                          • API String ID: 457041351-4108050209
                                          • Opcode ID: 3615df20228cdcb6db4211d6fb81b5e6443966eec406a840a87f106c8aa7a10e
                                          • Instruction ID: 188b1af41c983b0a3c887034a9ffd0b046b24e77ffa72695de80a319f314583b
                                          • Opcode Fuzzy Hash: 3615df20228cdcb6db4211d6fb81b5e6443966eec406a840a87f106c8aa7a10e
                                          • Instruction Fuzzy Hash: 1F917DB1908705DFD320CF54C980B5AB7F8FF8A704F118A2EE5A587255DB71E948CBA2
                                          Function 6A6848F0 Relevance: 13.6, APIs: 9, Instructions: 113networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?destinationAddress@QNetworkDatagram@@QBE?AVQHostAddress@@XZ.QT5NETWORK(?), ref: 6A68490D
                                            • Part of subcall function 6A66F3E0: ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK ref: 6A66F3EA
                                          • ??0QHostAddress@@QAE@W4SpecialAddress@0@@Z.QT5NETWORK(00000004), ref: 6A68491A
                                            • Part of subcall function 6A669D80: ??0QMutex@@QAE@XZ.QT5CORE ref: 6A669D92
                                            • Part of subcall function 6A669D80: ??0QString@@QAE@XZ.QT5CORE ref: 6A669D9B
                                            • Part of subcall function 6A669D80: ?setAddress@QHostAddress@@QAEXW4SpecialAddress@1@@Z.QT5NETWORK(?), ref: 6A669DBE
                                            • Part of subcall function 6A6841C0: ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK(?,?,?,6A684A5D,?,00000000,?,?), ref: 6A6841CB
                                            • Part of subcall function 6A6841C0: ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK(?,?,?,6A684A5D,?,00000000,?,?), ref: 6A6841DD
                                            • Part of subcall function 6A6841C0: ?toString@QHostAddress@@QBE?AVQString@@XZ.QT5NETWORK(?,?,?,?,?,6A684A5D,?,00000000,?,?), ref: 6A684202
                                            • Part of subcall function 6A6841C0: ??1QString@@QAE@XZ.QT5CORE(00000000,?,?,?,?,?,6A684A5D,?,00000000,?,?), ref: 6A684213
                                            • Part of subcall function 6A6841C0: ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK(?,?,6A684A5D,?,00000000,?,?), ref: 6A68421B
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK(00000000,00000000,00000000), ref: 6A684934
                                            • Part of subcall function 6A669E10: ??1QString@@QAE@XZ.QT5CORE(00000000,6A6ABD95,?), ref: 6A669E29
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK(00000000,00000000,00000000), ref: 6A68493D
                                          • ?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ.QT5NETWORK(00000000,00000000,00000000), ref: 6A684957
                                          • ?bind@QAbstractSocket@@QAE_NGV?$QFlags@W4BindFlag@QAbstractSocket@@@@@Z.QT5NETWORK(00000000,?,00000000,00000000,00000000), ref: 6A68496D
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(00000000,00000000,00000000), ref: 6A684993
                                          • ?bytesWritten@QIODevice@@QAEX_J@Z.QT5CORE(00000000,?,?,-00000004), ref: 6A6849CF
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Address@@Host$Abstract$Socket@@String@@$Network$?protocol@LayerProtocol@$Address@Special$?bind@?bytes?data@?destination?set?state@Address@0@@Address@1@@Authenticator@@BindChar@@Datagram@@Device@@Flag@Flags@Mutex@@SharedSocketSocket@@@@@State@1@String@V0@@Written@
                                          • String ID:
                                          • API String ID: 3081495741-0
                                          • Opcode ID: 660b3b49dfe490f70ca4d360a6952951131e96056710cc1b783ae44acdc62115
                                          • Instruction ID: 2756c58ebca3e30aef267071a819becfab97b869ff7c50d845c2251f19b9cea3
                                          • Opcode Fuzzy Hash: 660b3b49dfe490f70ca4d360a6952951131e96056710cc1b783ae44acdc62115
                                          • Instruction Fuzzy Hash: FE31BFB57043009FC704DF69C888A6AB7E9EF89224F024569ED4597352DF71EC08CBB6
                                          Function 6A630800 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 33COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?property@QObject@@QBE?AVQVariant@@PBD@Z.QT5CORE(?,_q_networksession,6BB77DA0,6A630F58,?,?,-00000008), ref: 6A630810
                                          • ?setProperty@QObject@@QAE_NPBDABVQVariant@@@Z.QT5CORE(_q_networksession,00000000,?,-00000008,?,?,?,?,?,?,?,?,?,?,6A62C7E7), ref: 6A63081E
                                          • ??1QVariant@@QAE@XZ.QT5CORE(?,-00000008,?,?,?,?,?,?,?,?,?,?,6A62C7E7), ref: 6A630828
                                          • ?isListening@QTcpServer@@QBE_NXZ.QT5NETWORK(?,-00000008,?,?,?,?,?,?,?,?,?,?,6A62C7E7), ref: 6A630830
                                          • ?listen@QTcpServer@@QAE_NABVQHostAddress@@G@Z.QT5NETWORK(?,00000000,?,-00000008,?,?,?,?,?,?,?,?,?,?,6A62C7E7), ref: 6A630841
                                            • Part of subcall function 6A6851B0: ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A6851CA
                                            • Part of subcall function 6A6851B0: ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QTcpServer::listen() called when already listening), ref: 6A6851D6
                                          • ?serverPort@QTcpServer@@QBEGXZ.QT5NETWORK(?,-00000008,?,?,?,?,?,?,?,?,?,?,6A62C7E7), ref: 6A630856
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Server@@$Logger@@MessageObject@@Variant@@$?listen@?property@?server?set?warning@Address@@HostListening@Port@Property@Variant@@@
                                          • String ID: _q_networksession
                                          • API String ID: 3902255088-1958377264
                                          • Opcode ID: 56ac5ee9671b0f0deec03f3a9ae029a52460a5a8fe98b4b98a399ecff52e1a5f
                                          • Instruction ID: b1754541d292d6a219949932c1ae9ebebc5ad621bcfbf6b095b67fd003a3334d
                                          • Opcode Fuzzy Hash: 56ac5ee9671b0f0deec03f3a9ae029a52460a5a8fe98b4b98a399ecff52e1a5f
                                          • Instruction Fuzzy Hash: 89F027B41000305BDF01BB158C189AE7774DF81718F811549EE9793691EF35090F82EA
                                          Function 6A636070 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(?,?), ref: 6A63622F
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A63623A
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A636244
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A6362D1
                                          • ?critical@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,integer is too big), ref: 6A6362DD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@ByteLogger@@Message$?critical@DateTime@@V0@$$V0@@
                                          • String ID: integer is too big
                                          • API String ID: 3433605455-4011386676
                                          • Opcode ID: 4e7c0a63fa4a905aa29d9e0bffc9ddd8e9045b54fc6c9ae5d2ff5de92d61650b
                                          • Instruction ID: 5efe7779e8de6585d60198f65b608483d3ddf79f0cf83dfa6dc325bd6f3e0268
                                          • Opcode Fuzzy Hash: 4e7c0a63fa4a905aa29d9e0bffc9ddd8e9045b54fc6c9ae5d2ff5de92d61650b
                                          • Instruction Fuzzy Hash: AF9137B5A043619BD704CF28C89075BFBE0FB85314F059A3EE959D3341DB75D84A8B92
                                          Function 6A690970 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A69098D
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QLocalServer::listen() called when already listening), ref: 6A690999
                                          • ?clear@QString@@QAEXXZ.QT5CORE ref: 6A6909AB
                                          • ?clear@QString@@QAEXXZ.QT5CORE ref: 6A6909B4
                                          Strings
                                          • QLocalServer::listen() called when already listening, xrefs: 6A690993
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?clear@Logger@@MessageString@@$?warning@
                                          • String ID: QLocalServer::listen() called when already listening
                                          • API String ID: 1391550703-3743882776
                                          • Opcode ID: dc09ab2e3eb7ceec3ca56232c2058fa06422bb102d80c35850c7256781875b8f
                                          • Instruction ID: 657c9b6bcf7f565dbac0b3082704ec36f7cfa1ae8f2bb7b5cb1c34f9a5936a98
                                          • Opcode Fuzzy Hash: dc09ab2e3eb7ceec3ca56232c2058fa06422bb102d80c35850c7256781875b8f
                                          • Instruction Fuzzy Hash: 1AF0E2B10102119FCF00EB14CD09B8ABBF0BF01305F528459EA4393192DB70F919CBA6
                                          Function 6A69E240 Relevance: 6.1, APIs: 4, Instructions: 87COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ebaa7b32425b07d594f30aacf78698949ad2d34871c588e092951eedc96a422c
                                          • Instruction ID: 8b74edb5ac88f6ba812cbef7f89552dabf71a8334ede5b398a8ceda578fbd701
                                          • Opcode Fuzzy Hash: ebaa7b32425b07d594f30aacf78698949ad2d34871c588e092951eedc96a422c
                                          • Instruction Fuzzy Hash: 5F319E716083428FDB00EF58C484B9ABBE4FF85319F4844BDED499B212DB35A949CBA1
                                          Function 6A692A40 Relevance: 3.0, APIs: 2, Instructions: 29synchronizationCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isListening@QLocalServer@@QBE_NXZ.QT5NETWORK(?,6A690D4F,?,?), ref: 6A692A51
                                          • WaitForSingleObject.KERNEL32(?,?,?,6A690D4F,?,?), ref: 6A692A6B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Listening@LocalObjectServer@@SingleWait
                                          • String ID:
                                          • API String ID: 1870608955-0
                                          • Opcode ID: 65fc8f0bc565d3d9cf137d7d24a8681782f7df0d2866e35f32026809906dcc5c
                                          • Instruction ID: 502b932b15472a8dae57e7ffe0133a0a4a0ce156c4a7cc2a684b521897dcc6e6
                                          • Opcode Fuzzy Hash: 65fc8f0bc565d3d9cf137d7d24a8681782f7df0d2866e35f32026809906dcc5c
                                          • Instruction Fuzzy Hash: 72F082322041828FD760D628D98199ABBA6EF41330F124B99F4A5CB1D5CB30EC81CB91
                                          Function 6A616370 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(?,?,00000003,?), ref: 6A61638E
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$?activate@Meta
                                          • String ID:
                                          • API String ID: 1938966063-0
                                          • Opcode ID: db8ad72a48c60dd577e77597913fcb8d1be9a97fc1462eacd63fe71ef762b1bb
                                          • Instruction ID: 7972279c72e463973d455d1814666e5761aa84ee39033ad96edd843840283936
                                          • Opcode Fuzzy Hash: db8ad72a48c60dd577e77597913fcb8d1be9a97fc1462eacd63fe71ef762b1bb
                                          • Instruction Fuzzy Hash: 65D0CAB0408200AEE320AF14CD41B5ABBF8AB40300F40892AE986D2240EA3596288AA6
                                          Function 6A69EA90 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A69EAA0
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@ByteV0@@
                                          • String ID:
                                          • API String ID: 2622163226-0
                                          • Opcode ID: a2ee3ba1ccc2fdbbbb175f7b97c9b172d4515101d3c8d9d25a768cfee8d29bd5
                                          • Instruction ID: cb84e76636d0f835a9a3682f3d985b45cd9454ddedb2d2b30088f143d3522709
                                          • Opcode Fuzzy Hash: a2ee3ba1ccc2fdbbbb175f7b97c9b172d4515101d3c8d9d25a768cfee8d29bd5
                                          • Instruction Fuzzy Hash: 20C0027A608220ABC7659F55D548886FBE0EFA9661B01881EB9DA83600DA30AC94DB91
                                          Function 6A690840 Relevance: .0, Instructions: 5COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: adeac53f8f485b092dcdd2b03f93e8e0610151e3f68a0b27179980c460ce8c30
                                          • Instruction ID: 0861e5b09af3d32a07c34aca1c46748745f72c6b7f98b3b21ee0d80519dd8320
                                          • Opcode Fuzzy Hash: adeac53f8f485b092dcdd2b03f93e8e0610151e3f68a0b27179980c460ce8c30
                                          • Instruction Fuzzy Hash: 65B00235115101DFD740CB05C345F4877E1AF453D5F5AD0D4D4044F552C375DD55DA41
                                          Function 6A68A960 Relevance: 115.9, APIs: 57, Strings: 9, Instructions: 380networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?toString@QHostAddress@@QBE?AVQString@@XZ.QT5NETWORK(?,?,?,?), ref: 6A68A99C
                                            • Part of subcall function 6A66BA20: ??0QString@@QAE@XZ.QT5CORE(00000000,00000000,?,?), ref: 6A66BA2D
                                            • Part of subcall function 6A66BA20: ?toString@QIPAddressUtils@@YAXAAVQString@@QBE@Z.QT5CORE(?,?,00000000), ref: 6A66BA56
                                            • Part of subcall function 6A66BA20: ??0QString@@QAE@HW4Initialization@Qt@@@Z.QT5CORE(?), ref: 6A66BA78
                                            • Part of subcall function 6A66BA20: ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A66BA82
                                            • Part of subcall function 6A66BA20: ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(?), ref: 6A66BA92
                                            • Part of subcall function 6A66BA20: ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?), ref: 6A66BAAC
                                            • Part of subcall function 6A66BA20: memmove.VCRUNTIME140(00000002,00000000), ref: 6A66BAB7
                                            • Part of subcall function 6A66BA20: ?append@QString@@QAEAAV1@ABV1@@Z.QT5CORE(?,?,?,00000000), ref: 6A66BAC6
                                            • Part of subcall function 6A66BA20: ??1QString@@QAE@XZ.QT5CORE(?,?,00000000), ref: 6A66BAD0
                                          • ?toLatin1@QString@@QHAE?AVQByteArray@@XZ.QT5CORE(?,?,?,?,?), ref: 6A68A9A8
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A68A9B3
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A68A9BD
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A68A9C7
                                          • ?toAce@QUrl@@SA?AVQByteArray@@ABVQString@@@Z.QT5CORE(?,00000068,?,?,?), ref: 6A68A9D5
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000,?,?), ref: 6A68A9E3
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?), ref: 6A68A9ED
                                          • ?number@QByteArray@@SA?AV1@HH@Z.QT5CORE(?,?,0000000A,?,?), ref: 6A68A9FF
                                          • ??0QByteArray@@QAE@HW4Initialization@Qt@@@Z.QT5CORE(00000001,00000000,?,?,?,?,?), ref: 6A68AA25
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,?,?), ref: 6A68AA2F
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,?,?), ref: 6A68AA3F
                                          • ?cend@QByteArray@@QBEPBDXZ.QT5CORE(?,?,?,?,?), ref: 6A68AA4B
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,?,?), ref: 6A68AA68
                                          • ?cend@QByteArray@@QBEPBDXZ.QT5CORE(?,?,?,?,?), ref: 6A68AA72
                                          • ?resize@QByteArray@@QAEXH@Z.QT5CORE(?,?,?,?,?,?), ref: 6A68AA9D
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?), ref: 6A68AAA3
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(?,000000FF,?,?,?,?,?), ref: 6A68AAB4
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(00000020,?,?,?,?,?), ref: 6A68AAC0
                                          • ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(?,?,?,?,?,?), ref: 6A68AACF
                                          • ?append@QByteArray@@QAEAAV1@PBD@Z.QT5CORE( HTTP/1.1,?,?,?,?,?), ref: 6A68AAE4
                                          • ?append@QByteArray@@QAEAAV1@PBD@Z.QT5CORE(Proxy-Connection: keep-alive,?,?,?,?,?), ref: 6A68AAEF
                                          • ?reserve@QByteArray@@QAEXH@Z.QT5CORE(00000000,?,?,?,?,?), ref: 6A68AB09
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE(?,?,?,?,?), ref: 6A68AB1A
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,?,?), ref: 6A68AB3E
                                          • ?cend@QByteArray@@QBEPBDXZ.QT5CORE(?,?,?,?,?), ref: 6A68AB4A
                                          • ?resize@QByteArray@@QAEXH@Z.QT5CORE(00000000,?,?,?,?,?), ref: 6A68AB78
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(User-Agent,000000FF,?,?,?,?,?), ref: 6A68AB85
                                          • ?hasRawHeader@QNetworkProxy@@QBE_NABVQByteArray@@@Z.QT5NETWORK(?,?,?,?,?,?), ref: 6A68AB9D
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?), ref: 6A68ABA8
                                          • ?append@QByteArray@@QAEAAV1@PBD@Z.QT5CORE(User-Agent: Mozilla/5.0,?,?,?,?,?), ref: 6A68ABBB
                                          • ?rawHeaderList@QNetworkProxy@@QBE?AV?$QList@VQByteArray@@@@XZ.QT5NETWORK(?,?,?,?,?,?), ref: 6A68ABC8
                                          • ?rawHeader@QNetworkProxy@@QBE?AVQByteArray@@ABV2@@Z.QT5NETWORK(?,?,?,?,?,?,?), ref: 6A68ABF8
                                          • ?reserve@QByteArray@@QAEXH@Z.QT5CORE(00000000,?,?,?,?,?), ref: 6A68AC20
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE(?,?,?,?,?), ref: 6A68AC31
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,?,?), ref: 6A68AC3B
                                          • ?cend@QByteArray@@QBEPBDXZ.QT5CORE(?,?,?,?,?), ref: 6A68AC45
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,?,?), ref: 6A68AC72
                                          • ?cend@QByteArray@@QBEPBDXZ.QT5CORE(?,?,?,?,?), ref: 6A68AC7E
                                          • ?resize@QByteArray@@QAEXH@Z.QT5CORE(?,?,?,?,?,?), ref: 6A68ACBC
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?), ref: 6A68ACC2
                                          • ?hostName@QNetworkProxy@@QBE?AVQString@@XZ.QT5NETWORK(?,?,?,?,?,?), ref: 6A68ACFE
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(?,000000FF,?,?,?,?,?,?), ref: 6A68AD10
                                          • ?reserve@QByteArray@@QAEXH@Z.QT5CORE(-00000015,?,?,?,00000000,?,?,?,?,?), ref: 6A68AD45
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE(?,?,?,?,?), ref: 6A68AD56
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,?,?), ref: 6A68AD73
                                          • ?cend@QByteArray@@QBEPBDXZ.QT5CORE(?,?,?,?,?), ref: 6A68AD7D
                                          • ?resize@QByteArray@@QAEXH@Z.QT5CORE(-00000015,?,?,?,?,?), ref: 6A68AD99
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?), ref: 6A68ADA3
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?), ref: 6A68ADAD
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?), ref: 6A68ADB7
                                          • ?append@QByteArray@@QAEAAV1@PBD@Z.QT5CORE(6A6C45D0,?,?,?,?,?), ref: 6A68ADC6
                                          • ?append@QByteArray@@QAEAAV1@PBD@Z.QT5CORE(6A6C45D0,?,?,?,?,?), ref: 6A68ADD9
                                          • ?write@QIODevice@@QAE_JABVQByteArray@@@Z.QT5CORE(?,?,?,?,?,?), ref: 6A68ADE7
                                            • Part of subcall function 6A613140: ??1QByteArray@@QAE@XZ.QT5CORE(00000001,?,00000094,6A6959F5), ref: 6A613185
                                            • Part of subcall function 6A613140: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000094,00000001,?,00000094,6A6959F5), ref: 6A613190
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?), ref: 6A68AE01
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?), ref: 6A68AE0B
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?), ref: 6A68AE15
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$Array@@$String@@$Char@@$?data@$?append@$?cend@$?resize@NetworkProxy@@$?begin@?reserve@$?rawArray@@@E@$$Header@Initialization@List@Qt@@@String@V0@@V1@@$?dispose@?has?host?number@?write@Ace@AddressAddress@@Array@@@@Char@@@Data@1@@Data@@Device@@HeaderHostLatin1Latin1@ListName@String@@@Url@@Utils@@V2@@memmove
                                          • String ID: HTTP/1.1$:$CONN$ECT$Host: $Proxy-Authorization: $Proxy-Connection: keep-alive$User-Agent$User-Agent: Mozilla/5.0
                                          • API String ID: 1067571571-748792055
                                          • Opcode ID: 01e58935ec338e8a6d2ce07340b75b44d0dc49dfd278f928a1d80d86131b8fe9
                                          • Instruction ID: 42c037240ae9179bc75cda06df294d8d588f808ff9bc17d831f03b4cf533edff
                                          • Opcode Fuzzy Hash: 01e58935ec338e8a6d2ce07340b75b44d0dc49dfd278f928a1d80d86131b8fe9
                                          • Instruction Fuzzy Hash: 94E17FB11082428FCB04DF65C49895ABBF9FF95309F06496DE89797291EF30ED09CB92
                                          Function 6A67CAA0 Relevance: 105.5, APIs: 53, Strings: 7, Instructions: 451libraryloadertimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WaitForMultipleObjects.KERNEL32(?,?,00000000,00000000,00000000,6BB6C190,?), ref: 6A67CABD
                                          • ?clear@QString@@QAEXXZ.QT5CORE(6BBE0EA0,00000000,6BB6C190,?), ref: 6A67CAE3
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A67CB5C
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A67CB68
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A67CB74
                                          • ??0QNetworkProxy@@QAE@W4ProxyType@0@ABVQString@@G11@Z.QT5NETWORK(00000002,00000000,00000000,00000000,00000000), ref: 6A67CB85
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(00000002,7FFFFFFF,00000001,00000002,00000000,00000000,00000000,00000000), ref: 6A67CBAE
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(00000002,00000002,00000000,00000000,00000000,00000000), ref: 6A67CBBE
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(00000002,00000002,00000000,00000000,00000000,00000000), ref: 6A67CBC6
                                          • ??1QNetworkProxy@@QAE@XZ.QT5NETWORK ref: 6A67CBD6
                                          • ??1QString@@QAE@XZ.QT5CORE(00000002,7FFFFFFF,00000001,00000002,00000000,00000000,00000000,00000000), ref: 6A67CBDF
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A67CBE9
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A67CBF3
                                          • ??1QString@@QAE@XZ.QT5CORE(80000001,?), ref: 6A67CC25
                                          • ??1QString@@QAE@XZ.QT5CORE(80000002,6A7005C8), ref: 6A67CC49
                                          • ??1QString@@QAE@XZ.QT5CORE(80000002,6A700650), ref: 6A67CC6D
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A67CC77
                                          • ?fromWCharArray@QString@@SA?AV1@PB_WH@Z.QT5CORE(?,winhttp,000000FF), ref: 6A67CC89
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A67CC97
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A67CCA1
                                          • ?utf16@QString@@QBEPBGXZ.QT5CORE ref: 6A67CCC0
                                          • ?load@QSystemLibrary@@SAPAUHINSTANCE__@@PB_W_N@Z.QT5CORE(00000000), ref: 6A67CCC9
                                          • GetProcAddress.KERNEL32(00000000,WinHttpOpen), ref: 6A67CCEB
                                          • ?utf16@QString@@QBEPBGXZ.QT5CORE(00000001), ref: 6A67CD00
                                          • ?load@QSystemLibrary@@SAPAUHINSTANCE__@@PB_W_N@Z.QT5CORE(00000000), ref: 6A67CD03
                                          • GetProcAddress.KERNEL32(?,WinHttpCloseHandle), ref: 6A67CD26
                                          • ?utf16@QString@@QBEPBGXZ.QT5CORE(00000001), ref: 6A67CD42
                                          • ?load@QSystemLibrary@@SAPAUHINSTANCE__@@PB_W_N@Z.QT5CORE(00000000), ref: 6A67CD45
                                          • GetProcAddress.KERNEL32(?,WinHttpGetProxyForUrl), ref: 6A67CD62
                                          • ?utf16@QString@@QBEPBGXZ.QT5CORE(00000001), ref: 6A67CD7E
                                          • ?load@QSystemLibrary@@SAPAUHINSTANCE__@@PB_W_N@Z.QT5CORE(00000000), ref: 6A67CD81
                                          • GetProcAddress.KERNEL32(?,WinHttpGetDefaultProxyConfiguration), ref: 6A67CD9E
                                          • ?utf16@QString@@QBEPBGXZ.QT5CORE(00000001), ref: 6A67CDBA
                                          • ?load@QSystemLibrary@@SAPAUHINSTANCE__@@PB_W_N@Z.QT5CORE(00000000), ref: 6A67CDBD
                                          • GetProcAddress.KERNEL32(?,WinHttpGetIEProxyConfigForCurrentUser), ref: 6A67CDD5
                                          • ?fromWCharArray@QString@@SA?AV1@PB_WH@Z.QT5CORE(?,?,000000FF,?), ref: 6A67CE08
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000,?,?,?,?,00000001), ref: 6A67CE17
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,00000001), ref: 6A67CE21
                                          • GlobalFree.KERNEL32(?), ref: 6A67CE2B
                                          • ?fromWCharArray@QString@@SA?AV1@PB_WH@Z.QT5CORE(?,?,000000FF,?), ref: 6A67CE42
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,00000001), ref: 6A67CE80
                                          • GlobalFree.KERNEL32(?), ref: 6A67CE8A
                                          • ?fromWCharArray@QString@@SA?AV1@PB_WH@Z.QT5CORE(?,?,000000FF,?), ref: 6A67CE9C
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,00000001), ref: 6A67CEDA
                                          • GlobalFree.KERNEL32(?), ref: 6A67CEE4
                                          • ?fromWCharArray@QString@@SA?AV1@PB_WH@Z.QT5CORE(?,?,000000FF), ref: 6A67CF46
                                            • Part of subcall function 6A67E370: ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(?,?,00000000,00000001), ref: 6A67E3A0
                                            • Part of subcall function 6A67E370: ?indexOf@QString@@QBEHVQChar@@HW4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000000,00000001), ref: 6A67E3A8
                                            • Part of subcall function 6A67E370: ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(?,?,00000000,00000001,?,00000000,00000001), ref: 6A67E3B6
                                            • Part of subcall function 6A67E370: ?indexOf@QString@@QBEHVQChar@@HW4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000000,00000001,?,00000000,00000001), ref: 6A67E3BE
                                            • Part of subcall function 6A67E370: ?mid@QString@@QBE?AV1@HH@Z.QT5CORE(?,00000001,00000000,?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E3F4
                                            • Part of subcall function 6A67E370: ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(00000020,00000001,?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E439
                                            • Part of subcall function 6A67E370: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E463
                                            • Part of subcall function 6A6132C0: ??1QString@@QAE@XZ.QT5CORE(00000000,6A6D0084,00000000,6A694819), ref: 6A613305
                                            • Part of subcall function 6A6132C0: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,00000000,6A6D0084,00000000,6A694819), ref: 6A613310
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,00000001), ref: 6A67CF84
                                          • ?fromWCharArray@QString@@SA?AV1@PB_WH@Z.QT5CORE(?,?,000000FF,?,?,?,?,?,?,00000001), ref: 6A67CF95
                                            • Part of subcall function 6A67E370: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E4A3
                                            • Part of subcall function 6A67E370: ??1QString@@QAE@XZ.QT5CORE(?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E4F5
                                            • Part of subcall function 6A67E370: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E500
                                            • Part of subcall function 6A67E370: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,6A702ECC,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6A67E51E
                                            • Part of subcall function 6A67E370: ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000001), ref: 6A67E532
                                            • Part of subcall function 6A67E370: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000000,?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E545
                                            • Part of subcall function 6A67E370: ?append@QListData@@QAEPAPAXXZ.QT5CORE(?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E54F
                                            • Part of subcall function 6A67E370: ??1QString@@QAE@XZ.QT5CORE(?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E55F
                                            • Part of subcall function 6A67E370: ?mid@QString@@QBE?AV1@HH@Z.QT5CORE(?,?,000000FF,?,00000000,00000001,?,00000000,00000001), ref: 6A67E57E
                                            • Part of subcall function 6A67E370: ??1QString@@QAE@XZ.QT5CORE(00000000,?,00000000,00000001,?,00000000,00000001), ref: 6A67E592
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6A67CFD3
                                          • GlobalFree.KERNEL32(?), ref: 6A67CFE2
                                          • GlobalFree.KERNEL32(?), ref: 6A67CFED
                                          • ?utf16@QString@@QBEPBGXZ.QT5CORE ref: 6A67D066
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A67D089
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$V0@@$?from?utf16@Array@Char$?load@AddressData@@E__@@FreeGlobalLibrary@@ListProcSystem$Array@@ByteChar@@$?append@?dispose@?index?mid@Authenticator@@CaseChar@@@Data@1@@DateLatin1NetworkProxy@@Qt@@@Sensitivity@SharedTime@@V0@$$$?clear@?detach_grow@Data@1@G11@MultipleObjectsProxyType@0@Wait
                                          • String ID: Qt System Proxy access/1.0$WinHttpCloseHandle$WinHttpGetDefaultProxyConfiguration$WinHttpGetIEProxyConfigForCurrentUser$WinHttpGetProxyForUrl$WinHttpOpen$winhttp
                                          • API String ID: 2472706036-1767786424
                                          • Opcode ID: fbfcd8e51c675bd5736fc0b2f55c8c774532e1e5bdf9ebef11d6a436cb48a0cc
                                          • Instruction ID: 3ac8c06e816e47b70dde19c2b29af05205fda46c5e5f1e753b75410826223f63
                                          • Opcode Fuzzy Hash: fbfcd8e51c675bd5736fc0b2f55c8c774532e1e5bdf9ebef11d6a436cb48a0cc
                                          • Instruction Fuzzy Hash: AE027AB05183409FCB40DF64C898A9ABBF8AF85304F11495DF856D7292EF74E948CFA2
                                          Function 6A6942A0 Relevance: 101.8, APIs: 54, Strings: 4, Instructions: 343timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?fromNativeSeparators@QDir@@SA?AVQString@@ABV2@@Z.QT5CORE(?,?), ref: 6A6942B6
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(?,?,000000FF,00000001), ref: 6A6942CF
                                          • ?lastIndexOf@QString@@QBEHVQChar@@HW4CaseSensitivity@Qt@@@Z.QT5CORE(?,000000FF,00000001), ref: 6A6942D9
                                          • ?left@QString@@QBE?AV1@H@Z.QT5CORE(?,00000000,?,000000FF,00000001), ref: 6A6942EF
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(00000005,[*?[],?,000000FF,00000001), ref: 6A69430B
                                          • ??0QRegExp@@QAE@ABVQString@@W4CaseSensitivity@Qt@@W4PatternSyntax@0@@Z.QT5CORE(?,00000001,00000000,00000000,?,000000FF,00000001), ref: 6A69431E
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(0000001C,[\$\(\)\*\+\.\?\[\]\^\{\}\|],?,000000FF,00000001), ref: 6A69433A
                                          • ??0QRegExp@@QAE@ABVQString@@W4CaseSensitivity@Qt@@W4PatternSyntax@0@@Z.QT5CORE(?,00000001,00000000,00000000,?,000000FF,00000001), ref: 6A69434F
                                          • ?indexOf@QString@@QBEHABVQRegExp@@H@Z.QT5CORE(00000000,?,000000FF,00000001), ref: 6A694356
                                          • ??1QString@@QAE@XZ.QT5CORE(?,000000FF,00000001), ref: 6A69436D
                                          • ?left@QString@@QBE?AV1@H@Z.QT5CORE(?,00000000,?,000000FF,00000001), ref: 6A694382
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000,?,000000FF,00000001), ref: 6A694389
                                          • ??1QString@@QAE@XZ.QT5CORE(?,000000FF,00000001), ref: 6A694393
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(0000002F,?,?,?,?,?,?,?,?,?,?,?,000000FF,00000001,?,000000FF), ref: 6A6943A9
                                          • ?lastIndexOf@QString@@QBEHVQChar@@HW4CaseSensitivity@Qt@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,000000FF,00000001,?,000000FF,00000001), ref: 6A6943B3
                                          • ?left@QString@@QBE?AV1@H@Z.QT5CORE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,000000FF,00000001), ref: 6A6943C8
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000,?,?,?,?,?,?,?,?,?,?,?,000000FF,00000001,?,000000FF), ref: 6A6943CF
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,000000FF,00000001,?,000000FF,00000001), ref: 6A6943D9
                                          • ?clear@QString@@QAEXXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,000000FF,00000001,?,000000FF,00000001), ref: 6A6943E4
                                          • ??4QString@@QAEAAV0@VQLatin1String@@@Z.QT5CORE(00000001,6A6CFF20,?,000000FF,00000001), ref: 6A6944C3
                                          • ??0QRegExp@@QAE@ABVQString@@W4CaseSensitivity@Qt@@W4PatternSyntax@0@@Z.QT5CORE(?,00000001,?,?,000000FF,00000001), ref: 6A6944E3
                                          • ??0QDirIterator@@QAE@ABVQString@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4IteratorFlag@QDirIterator@@@@@Z.QT5CORE(?,?,00000003,?,000000FF,00000001), ref: 6A6944FD
                                          • ?hasNext@QDirIterator@@QBE_NXZ.QT5CORE(?,00000003,?,000000FF,00000001), ref: 6A694507
                                          • ?mid@QString@@QBE?AV1@HH@Z.QT5CORE(?,00000000,000000FF,?,00000003,?,000000FF,00000001), ref: 6A694550
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000,?,00000003,?,000000FF,00000001), ref: 6A69455B
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000003,?,000000FF,00000001), ref: 6A69456D
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000003,?,000000FF,00000001), ref: 6A69457F
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000003,?,000000FF,00000001), ref: 6A694591
                                          • ?exactMatch@QRegExp@@QBE_NABVQString@@@Z.QT5CORE(0000002F,?,00000003,?,000000FF,00000001), ref: 6A6945A0
                                          • ??0QFile@@QAE@ABVQString@@@Z.QT5CORE(0000002F,?,00000003,?,000000FF,00000001), ref: 6A6945B7
                                          • ?open@QFile@@UAE_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z.QT5CORE(00000011,?,00000003,?,000000FF,00000001), ref: 6A6945D1
                                          • ?readAll@QIODevice@@QAE?AVQByteArray@@XZ.QT5CORE(?,?,?,00000003,?,000000FF,00000001), ref: 6A6945E9
                                          • ?fromData@QSslCertificate@@SA?AV?$QList@VQSslCertificate@@@@ABVQByteArray@@W4EncodingFormat@QSsl@@@Z.QT5NETWORK(?,00000000,?,00000003,?,000000FF,00000001), ref: 6A6945F5
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,?,00000000), ref: 6A694649
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A69465A
                                          • ??1QFile@@UAE@XZ.QT5CORE(?,00000003,?,000000FF,00000001), ref: 6A694664
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000003,?,000000FF,00000001), ref: 6A69466E
                                          • ?hasNext@QDirIterator@@QBE_NXZ.QT5CORE(?,00000003,?,000000FF,00000001), ref: 6A694678
                                          • ??1QDirIterator@@QAE@XZ.QT5CORE(?,00000003,?,000000FF,00000001), ref: 6A6946A2
                                          • ??1QRegExp@@QAE@XZ.QT5CORE(?,00000003,?,000000FF,00000001), ref: 6A6946AC
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,?,?,00000003,?,000000FF,00000001), ref: 6A6946F3
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A694700
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A69470A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Exp@@$CaseLatin1Sensitivity@String@@@$Array@@ByteChar@@Iterator@@$?left@File@@Flags@PatternQt@@Syntax@0@@V0@@$?dispose@?from?has?lastChar@@@Data@1@@Data@@DateFlag@IndexListNext@Qt@@@Time@@V0@$$$?clear@?exact?index?mid@?open@?readAll@Certificate@@Certificate@@@@Data@Device@@Device@@@@@Dir@@Dir@@@@E@$$EncodingFilter@Format@IteratorIterator@@@@@List@Match@ModeNativeOpenSeparators@Ssl@@@V2@@
                                          • String ID: /$/$[*?[]$[\$\(\)\*\+\.\?\[\]\^\{\}\|]
                                          • API String ID: 843148676-908938062
                                          • Opcode ID: 876ec4dc5cbd109d6bbfed1123ca3e1c85353260292f61cbdb0de488f977bb13
                                          • Instruction ID: 2d4a2af805025d34fa1052883c5ce767cb7ef7e2a8418a5cddbcfa7d96bc2476
                                          • Opcode Fuzzy Hash: 876ec4dc5cbd109d6bbfed1123ca3e1c85353260292f61cbdb0de488f977bb13
                                          • Instruction Fuzzy Hash: 2AD128B11082069FCB04DFA5C898A9ABBF8FF95715F01091DF5A7D31A0DB74AE09CB52
                                          Function 6A61EAA0 Relevance: 91.4, APIs: 49, Strings: 3, Instructions: 367timenetworkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?currentDateTimeUtc@QDateTime@@SA?AV1@XZ.QT5CORE ref: 6A61EAB5
                                          • ?scheme@QUrl@@QBE?AVQString@@XZ.QT5CORE(?), ref: 6A61EAD2
                                          • ??8QString@@QBE_NVQLatin1String@@@Z.QT5CORE(00000005,https), ref: 6A61EAE1
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61EAEF
                                          • ?name@QSslCertificateExtension@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A61EB1E
                                            • Part of subcall function 6A61CBA0: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE ref: 6A61CBAA
                                          • ?host@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(0000002E), ref: 6A61EB39
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(?,?,00000001), ref: 6A61EB4C
                                          • ?startsWith@QString@@QBE_NVQChar@@W4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000001), ref: 6A61EB56
                                          • ??8@YA_NABVQString@@0@Z.QT5CORE(?,?,?,00000001), ref: 6A61EB68
                                          • ?endsWith@QString@@QBE_NABV1@W4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000001,?,00000001), ref: 6A61EB81
                                          • ?midRef@QString@@QBE?AVQStringRef@@HH@Z.QT5CORE(?,00000001,000000FF,?,?,?,?,?,00000001), ref: 6A61EB9D
                                          • ??8@YA_NABVQString@@ABVQStringRef@@@Z.QT5CORE(?,00000000,?,?,?,?,?,00000001), ref: 6A61EBA8
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61EBD2
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61EBDC
                                          • ?value@QDnsDomainNameRecord@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A61EBF4
                                          • ?path@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A61EC0F
                                          • ??8QString@@QBE_NVQLatin1String@@@Z.QT5CORE(00000001,6A6C1058), ref: 6A61EC2C
                                          • ?startsWith@QString@@QBE_NABV1@W4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000001), ref: 6A61EC40
                                          • ?endsWith@QString@@QBE_NVQChar@@W4CaseSensitivity@Qt@@@Z.QT5CORE(00000000,00000001), ref: 6A61EC71
                                          • ?at@QString@@QBE?BVQChar@@H@Z.QT5CORE(?,00000000), ref: 6A61EC8D
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61ECA1
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61ECAB
                                          • ?isSessionCookie@QNetworkCookie@@QBE_NXZ.QT5NETWORK ref: 6A61ECB3
                                          • ?expirationDate@QNetworkCookie@@QBE?AVQDateTime@@XZ.QT5NETWORK(?), ref: 6A61ECC8
                                          • ??MQDateTime@@QBE_NABV0@@Z.QT5CORE(?), ref: 6A61ECD4
                                          • ??1QDateTime@@QAE@XZ.QT5CORE ref: 6A61ECFB
                                          • ?isSecure@QNetworkCookie@@QBE_NXZ.QT5NETWORK ref: 6A61ED0E
                                          • ?name@QSslCertificateExtension@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A61ED29
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(0000002E,?,00000001), ref: 6A61ED3C
                                          • ?startsWith@QString@@QBE_NVQChar@@W4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000001), ref: 6A61ED46
                                          • ?mid@QString@@QBE?AV1@HH@Z.QT5CORE(?,00000001,000000FF,?,00000001), ref: 6A61ED5D
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000,?,00000001), ref: 6A61ED68
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000001), ref: 6A61ED72
                                          • ?qIsEffectiveTLD@@YA_NABVQStringRef@@@Z.QT5CORE(?,?,00000001), ref: 6A61ED98
                                          • ?host@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A61EDBC
                                          • ??8@YA_NABVQString@@0@Z.QT5CORE(00000000,?), ref: 6A61EDC8
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61EDF2
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61EF71
                                            • Part of subcall function 6A61F060: ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(00000000,?,?,?,?,6A61EE11), ref: 6A61F08B
                                            • Part of subcall function 6A61F060: ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,?,?,?,6A61EE11), ref: 6A61F0B3
                                            • Part of subcall function 6A61F060: ??1QNetworkCookie@@QAE@XZ.QT5NETWORK(?,?,?,6A61EE11), ref: 6A61F0F6
                                            • Part of subcall function 6A61F060: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,?,?,?,6A61EE11), ref: 6A61F100
                                          • ?value@QDnsDomainNameRecord@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A61EE4B
                                            • Part of subcall function 6A61E5C0: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE ref: 6A61E5CA
                                          • ?value@QDnsDomainNameRecord@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A61EE62
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61EE74
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61EE7E
                                          • ?insert@QListData@@QAEPAPAXH@Z.QT5CORE(?), ref: 6A61EEEC
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A61EEF9
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,7FFFFFFF,00000001), ref: 6A61EF36
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A61EF46
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?), ref: 6A61EF4F
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61EF67
                                          • ??1QDateTime@@QAE@XZ.QT5CORE ref: 6A61EF86
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$V0@@$Date$Char@@Time@@$CaseQt@@@Sensitivity@With@$Authenticator@@Cookie@@Data@@Latin1ListNetworkSharedUrl@@$??8@?starts?value@ComponentDomainFlags@FormattingNameOption@Record@@StringUrl@@@@@$?ends?host@?name@Array@@ByteCertificateChar@@@Extension@@Ref@@@String@@0@String@@@$?append@?at@?current?detach@?dispose@?expiration?insert@?mid?mid@?path@?scheme@Cookie@Data@1@Data@1@@Date@EffectiveRef@Ref@@Secure@SessionTimeUtc@V0@$$
                                          • String ID: .$.$https
                                          • API String ID: 786642455-711833193
                                          • Opcode ID: 7abd1cb4782d6b5adabedccdb2e3a7b7b8efdb3575c3f53e44d5b3853bd9ea40
                                          • Instruction ID: 7c1bdf4f5d47f901a1b8094bebf759ce903e318defa22141c171235602a84856
                                          • Opcode Fuzzy Hash: 7abd1cb4782d6b5adabedccdb2e3a7b7b8efdb3575c3f53e44d5b3853bd9ea40
                                          • Instruction Fuzzy Hash: 83E121706083408FDB04CF68C898A6ABBF5BF8A708F01092DF596D72A1DB71ED45CB42
                                          Function 6A630870 Relevance: 91.3, APIs: 48, Strings: 4, Instructions: 346COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(-0000006C), ref: 6A630897
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6308A8
                                          • ?readAll@QIODevice@@QAE?AVQByteArray@@XZ.QT5CORE(?), ref: 6A6308EB
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6308F5
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(6A700168,6A700168,00000001,00000000), ref: 6A630CED
                                          Strings
                                          • ^(\d\d-\d\d-\d\d\ \ \d\d:\d\d[AP]M)\s+(<DIR>|\d+)\s+(\S.*)$, xrefs: 6A630A36
                                          • No such file or directory, xrefs: 6A630B0A
                                          • ^([\-dl])([a-zA-Z\-]{9,9})\s+\d+\s+(\S*)\s+(\S*)\s+(\d+)\s+(\S+\s+\S+\s+\S+)\s+(\S.*), xrefs: 6A6309C4
                                          • LIST, xrefs: 6A63091C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$Object@@$?activate@?readAll@Device@@MetaString@@V0@@
                                          • String ID: LIST$No such file or directory$^([\-dl])([a-zA-Z\-]{9,9})\s+\d+\s+(\S*)\s+(\S*)\s+(\d+)\s+(\S+\s+\S+\s+\S+)\s+(\S.*)$^(\d\d-\d\d-\d\d\ \ \d\d:\d\d[AP]M)\s+(<DIR>|\d+)\s+(\S.*)$
                                          • API String ID: 437897471-479807705
                                          • Opcode ID: ac841115a96f048edaedf3aedfa39f0e5a925cc4fb5a57eb0f3b4b37b05ad82e
                                          • Instruction ID: 34bb9cfbadb5611815a56a88d5880b0070dadbf2ef9d8352c12e6b04c37f2126
                                          • Opcode Fuzzy Hash: ac841115a96f048edaedf3aedfa39f0e5a925cc4fb5a57eb0f3b4b37b05ad82e
                                          • Instruction Fuzzy Hash: 42E1E4B11043019FDB44DB65C898A9ABBF4FF99705F42491DF59BC32A0EB71EA09CB42
                                          Function 6A632840 Relevance: 89.6, APIs: 45, Strings: 6, Instructions: 388networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QNetworkProxy@@QAE@XZ.QT5NETWORK ref: 6A63284D
                                          • ?type@QNetworkProxy@@QBE?AW4ProxyType@1@XZ.QT5NETWORK ref: 6A63287A
                                          • ?type@QNetworkProxy@@QBE?AW4ProxyType@1@XZ.QT5NETWORK ref: 6A632886
                                          • ??4QNetworkProxy@@QAEAAV0@ABV0@@Z.QT5NETWORK(?), ref: 6A63289E
                                          • ?type@QNetworkProxy@@QBE?AW4ProxyType@1@XZ.QT5NETWORK ref: 6A6328A7
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,No suitable proxy found,00000000), ref: 6A6328C4
                                          • ??1QString@@QAE@XZ.QT5CORE(00000067,?), ref: 6A6328DC
                                          • ?path@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?,?,?), ref: 6A632912
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?), ref: 6A63291D
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(00000001,6A6C1058,?,?), ref: 6A632932
                                          • ?setPath@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z.QT5CORE(?,00000002,?,?), ref: 6A632943
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?), ref: 6A63294D
                                          • ?path@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?,?,?,?), ref: 6A632971
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(0000002F), ref: 6A632983
                                          • ?endsWith@QString@@QBE_NVQChar@@W4CaseSensitivity@Qt@@@Z.QT5CORE ref: 6A63298B
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A632997
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Cannot open %1: is a directory,00000000,000000FF), ref: 6A6329B8
                                          • ?toString@QUrl@@QBE?AVQString@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z.QT5CORE(?,00000000), ref: 6A6329C9
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(00000020), ref: 6A6329DD
                                          • ?arg@QString@@QBE?AV1@ABV1@HVQChar@@@Z.QT5CORE(?,00000000,00000000), ref: 6A6329EF
                                          • ??1QString@@QAE@XZ.QT5CORE(000000CA,00000000), ref: 6A632A06
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A632A10
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A632A1A
                                          • ?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPAU12@PBVQObject@@@Z.QT5CORE(00000000,00000000,00000001), ref: 6A632AA5
                                          • ?property@QObject@@QBE?AVQVariant@@PBD@Z.QT5CORE(?,_q_networksession), ref: 6A632AEE
                                          • ?setProperty@QObject@@QAE_NPBDABVQVariant@@@Z.QT5CORE(_q_networksession,00000000), ref: 6A632AFC
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A632B06
                                          • ?type@QNetworkProxy@@QBE?AW4ProxyType@1@XZ.QT5NETWORK ref: 6A632B10
                                          • ?port@QNetworkProxy@@QBEGXZ.QT5NETWORK ref: 6A632B33
                                          • ?hostName@QNetworkProxy@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A632B44
                                          • ??1QString@@QAE@XZ.QT5CORE(?), ref: 6A632B56
                                          • ?port@QUrl@@QBEHH@Z.QT5CORE(00000015), ref: 6A632B77
                                          • ?host@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A632B92
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A632BA5
                                          • ?password@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A632BD2
                                          • ?userName@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A632BEC
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A632BFF
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A632C09
                                          • ?wrap@QNonContiguousByteDeviceFactory@@SAPAVQIODevice@@PAVQNonContiguousByteDevice@@@Z.QT5CORE(00000000), ref: 6A632C74
                                          • ?setParent@QObject@@QAEXPAV1@@Z.QT5CORE ref: 6A632C83
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A632C8D
                                          • ??1QUrl@@QAE@XZ.QT5CORE ref: 6A632C97
                                          • ??1QNetworkProxy@@QAE@XZ.QT5NETWORK ref: 6A632CE5
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?), ref: 6A632CEF
                                          • ??1QNetworkProxy@@QAE@XZ.QT5NETWORK ref: 6A632CFC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$NetworkProxy@@Url@@$Formatting$ComponentFlags@Option@$Object@@Url@@@@@$?type@ProxyType@1@$?setByteChar@@Char@@@Latin1$?path@?port@?tr@ContiguousMetaName@Variant@@$?arg@?dispose@?ends?get?host?host@?password@?property@?user?wrap@Array@@CaseCountData@Data@1@@Data@@DeviceDevice@@Device@@@ExternalFactory@@ListMode@1@@Object@@@Option@2@@@@Parent@ParsingPath@Pointer@@Property@Qt@@@Ref@Sensitivity@SharedString@String@@@U12@V0@@V1@@Variant@@@With@
                                          • String ID: $1ftpConnectionReady(QNetworkAccessCache::CacheableObject*)$Cannot open %1: is a directory$HJlj$No suitable proxy found$_q_networksession
                                          • API String ID: 1355174759-2861965128
                                          • Opcode ID: 151b694953139629e0517c1d7ec7d6ff5940d5298a8499a62a70a9531895c5a9
                                          • Instruction ID: abcd103527d2853cc6583c06325526e88e222bce49103ae30a1d48c5d523973f
                                          • Opcode Fuzzy Hash: 151b694953139629e0517c1d7ec7d6ff5940d5298a8499a62a70a9531895c5a9
                                          • Instruction Fuzzy Hash: 25E18FB12042159BDB00DF75C898AAA77F8FF95318F020558F85AD7291DF34ED0ACBA6
                                          Function 6A650210 Relevance: 84.3, APIs: 41, Strings: 7, Instructions: 291COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?reserve@QByteArray@@QAEXH@Z.QT5CORE(00000200), ref: 6A650235
                                          • ?read@QIODevice@@QAE_JPAD_J@Z.QT5CORE(00000000,00000001,00000000), ref: 6A650271
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(00000000), ref: 6A650296
                                          • ?endsWith@QByteArray@@QBE_NPBD@Z.QT5CORE ref: 6A6502B4
                                          • ?endsWith@QByteArray@@QBE_NPBD@Z.QT5CORE(6A6C76AC), ref: 6A6502C1
                                          • ?endsWith@QByteArray@@QBE_NPBD@Z.QT5CORE(6A6C45D0), ref: 6A6502DB
                                          • ?endsWith@QByteArray@@QBE_NPBD@Z.QT5CORE(6A6C66EC), ref: 6A6502F0
                                          • ?clear@QByteArray@@QAEXXZ.QT5CORE ref: 6A65032D
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A650345
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(transfer-encoding,000000FF), ref: 6A65035E
                                          • ?toLower@QByteArray@@QHAE?AV1@XZ.QT5CORE(?,?,?,00000000), ref: 6A65037A
                                          • ?indexOf@QByteArray@@QBEHPBDH@Z.QT5CORE(chunked,00000000), ref: 6A650389
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A65039C
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6503A6
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6503B0
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6503BA
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6503C4
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(connection,000000FF), ref: 6A6503D7
                                            • Part of subcall function 6A64E6E0: ?compare@QByteArray@@QBEHABV1@W4CaseSensitivity@Qt@@@Z.QT5CORE(4C8D6A68,00000000,00000000,?,00000000,?,6A64F728,?,?,00000000), ref: 6A64E716
                                            • Part of subcall function 6A64E6E0: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,00000000,?,6A64F728,?,?,00000000), ref: 6A64E74B
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,00000000), ref: 6A6503F0
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6503FA
                                          • ?toLower@QByteArray@@QGBE?AV1@XZ.QT5CORE(?), ref: 6A65040E
                                          • ?indexOf@QByteArray@@QBEHPBDH@Z.QT5CORE(close,00000000), ref: 6A65041D
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A650430
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(proxy-connection,000000FF), ref: 6A650443
                                            • Part of subcall function 6A64E6E0: ??0QByteArray@@QAE@PBDH@Z.QT5CORE(6A6C26C8,000000FF,?,00000000,?,6A64F728,?,?,00000000), ref: 6A64E76F
                                            • Part of subcall function 6A64E6E0: ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A64E780
                                            • Part of subcall function 6A64E6E0: ?QByteArrayList_join@QtPrivate@@YA?AVQByteArray@@PBV?$QList@VQByteArray@@@@PBDH@Z.QT5CORE(?,?,00000000,?), ref: 6A64E792
                                            • Part of subcall function 6A64E6E0: ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A64E79F
                                          • ?toLower@QByteArray@@QHAE?AV1@XZ.QT5CORE(?,?,?,00000000), ref: 6A650468
                                          • ?indexOf@QByteArray@@QBEHPBDH@Z.QT5CORE(close,00000000), ref: 6A650477
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A65049C
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(proxy-connection,000000FF), ref: 6A6504AF
                                          • ?toLower@QByteArray@@QHAE?AV1@XZ.QT5CORE(?,?,?,00000000), ref: 6A6504D4
                                          • ?indexOf@QByteArray@@QBEHPBDH@Z.QT5CORE(keep-alive,00000000), ref: 6A6504E3
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A650509
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A65051D
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A65052F
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A650541
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A650553
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A650565
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A650577
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A650586
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A650590
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6505D2
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6505EB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$Array@@$String@@$?ends?indexLower@With@$?append@?clear@?compare@?data@?read@?reserve@ArrayArray@@@@CaseChar@@Device@@List@List_join@Private@@Qt@@@Sensitivity@V0@@
                                          • String ID: $chunked$close$connection$keep-alive$proxy-connection$transfer-encoding
                                          • API String ID: 3127752155-3393794172
                                          • Opcode ID: f8ead89a17044529d1759f451cddb6bab4af08d194e4b3a3d7d9dc4e70aa87bf
                                          • Instruction ID: 66a483830bd9d896c34f020890719371ecfb6c2fa253d5f5effee97e43629f82
                                          • Opcode Fuzzy Hash: f8ead89a17044529d1759f451cddb6bab4af08d194e4b3a3d7d9dc4e70aa87bf
                                          • Instruction Fuzzy Hash: D9B18B711483469FCB00DF65C858B9A7BF8AF86318F024618F6A7931D1DF34EA49CB52
                                          Function 6A634840 Relevance: 78.9, APIs: 40, Strings: 5, Instructions: 199timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A634864
                                          • ??0QDir@@QAE@ABVQString@@@Z.QT5CORE(?), ref: 6A63486F
                                          • ?absolutePath@QDir@@QBE?AVQString@@XZ.QT5CORE(?), ref: 6A63487E
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A634887
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A634891
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(0000002F), ref: 6A6348A5
                                          • ?endsWith@QString@@QBE_NVQChar@@W4CaseSensitivity@Qt@@@Z.QT5CORE ref: 6A6348AD
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(0000002F), ref: 6A6348C3
                                          • ??YQString@@QAEAAV0@VQChar@@@Z.QT5CORE ref: 6A6348CB
                                          • ?number@QString@@SA?AV1@HH@Z.QT5CORE(?,00000008,0000000A), ref: 6A6348DF
                                          • ??0QString@@QAE@HW4Initialization@Qt@@@Z.QT5CORE(?,00000000), ref: 6A63491C
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A634926
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?), ref: 6A63493B
                                          • memmove.VCRUNTIME140(00000000,00000000), ref: 6A634943
                                          • ?appendLatin1To@QAbstractConcatenable@@KAXPBDHPAVQChar@@@Z.QT5CORE(00000000,?,00000000,00000000,00000000), ref: 6A63495B
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?), ref: 6A63496E
                                          • memmove.VCRUNTIME140(00000000,00000000), ref: 6A634976
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(?), ref: 6A634986
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(?), ref: 6A6349A1
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6349AB
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6349B5
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6349BF
                                          • ??0QDir@@QAE@ABVQString@@@Z.QT5CORE(00000000), ref: 6A6349CA
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6349D4
                                          • ??0QString@@QAE@HW4Initialization@Qt@@@Z.QT5CORE(?,00000000), ref: 6A6349FC
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A634A06
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?), ref: 6A634A19
                                          • memmove.VCRUNTIME140(00000000,00000000), ref: 6A634A21
                                          • ?appendLatin1To@QAbstractConcatenable@@KAXPBDHPAVQChar@@@Z.QT5CORE(?,?,00000000,00000000,00000000), ref: 6A634A32
                                          • ?mkpath@QDir@@QBE_NABVQString@@@Z.QT5CORE(?), ref: 6A634A46
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A634A4C
                                          • ?mkpath@QDir@@QBE_NABVQString@@@Z.QT5CORE(?), ref: 6A634A5E
                                          • ?number@QString@@SA?AV1@IH@Z.QT5CORE(?,00000000,00000010), ref: 6A634A78
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A634A82
                                          • ?append@QString@@QAEAAV1@ABV1@@Z.QT5CORE(?), ref: 6A634A91
                                          • ?mkdir@QDir@@QBE_NABVQString@@@Z.QT5CORE(?), ref: 6A634AA0
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A634AA6
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A634AB0
                                          • ??1QDir@@QAE@XZ.QT5CORE ref: 6A634AC6
                                          • ??1QDir@@QAE@XZ.QT5CORE ref: 6A634ACC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Char@@$Dir@@$Char@@@$?data@Latin1String@@@$V0@@$Qt@@@memmove$?append?mkpath@?number@AbstractConcatenable@@DateInitialization@Time@@V0@$$$?absolute?append@?ends?mkdir@Array@@ByteCasePath@Sensitivity@V1@@With@
                                          • String ID: /$/$/$data$prepared/
                                          • API String ID: 745358802-810699478
                                          • Opcode ID: ed826a8ad9165365d9b337c77e6af2f19cad64c4940dda5df1592a63a4d27835
                                          • Instruction ID: a832dfb2786fb949536ad6f450e73f6a05f17f9afdc382ec263a3893ec573706
                                          • Opcode Fuzzy Hash: ed826a8ad9165365d9b337c77e6af2f19cad64c4940dda5df1592a63a4d27835
                                          • Instruction Fuzzy Hash: F88105B11042569FCB04DF55C898A5ABBF8FF8A305F01092DF586D32A1EB34ED49CB92
                                          Function 6A62AA10 Relevance: 78.9, APIs: 29, Strings: 16, Instructions: 158COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QObject@@QAE@PAV0@@Z.QT5CORE(00000000,?,00000000,?,?,00000030,6A62A867,00000000), ref: 6A62AA25
                                          • ??0QObject@@QAE@PAV0@@Z.QT5CORE ref: 6A62AA3A
                                          • ??0QTcpServer@@QAE@PAVQObject@@@Z.QT5NETWORK(00000040), ref: 6A62AA4F
                                            • Part of subcall function 6A684BF0: ??0QTcpServerPrivate@@QAE@XZ.QT5NETWORK ref: 6A684BFF
                                            • Part of subcall function 6A684BF0: ??0QObject@@IAE@AAVQObjectPrivate@@PAV0@@Z.QT5CORE(00000000,?), ref: 6A684C0B
                                          • ??0QString@@QAE@XZ.QT5CORE(00000040), ref: 6A62AA5A
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A62AA67
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(0000001B,QFtpDTP active state server), ref: 6A62AA83
                                          • ?setObjectName@QObject@@QAEXABVQString@@@Z.QT5CORE(00000000), ref: 6A62AA96
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A62AA9C
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(00000000,0000004C,2newConnection(),00000040,1setupSocket(),00000000), ref: 6A62AABB
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE(00000000), ref: 6A62AACA
                                          • ??0QTcpSocket@@QAE@PAVQObject@@@Z.QT5NETWORK(00000000), ref: 6A62AAD7
                                            • Part of subcall function 6A683F70: ??0QAbstractSocket@@IAE@W4SocketType@0@AAVQAbstractSocketPrivate@@PAVQObject@@@Z.QT5NETWORK ref: 6A683FA3
                                          • ??0QString@@QAE@XZ.QT5CORE(00000000), ref: 6A62AAE3
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A62AB06
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A62AB19
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(0000000D,QFtpPI_socket), ref: 6A62AB2A
                                          • ?setObjectName@QObject@@QAEXABVQString@@@Z.QT5CORE(?), ref: 6A62AB37
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A62AB3D
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2hostFound(),?,1hostFound(),00000000), ref: 6A62AB5A
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62AB63
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2connected(),?,1connected(),00000000), ref: 6A62AB78
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62AB81
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2disconnected(),?,1connectionClosed(),00000000), ref: 6A62AB96
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62AB9F
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2readyRead(),?,1readyRead(),00000000), ref: 6A62ABB4
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62ABBD
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2errorOccurred(QAbstractSocket::SocketError),?,1error(QAbstractSocket::SocketError),00000000), ref: 6A62ABD2
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62ABDB
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,00000030,2connectState(int),?,1dtpConnectState(int),00000000), ref: 6A62ABF3
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62ABFC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$Connection@Meta$String@@$?connect@ConnectionQt@@@Type@$String@@@$ObjectObject@@@Private@@V0@@$?setAbstractLatin1Name@SocketSocket@@$ServerServer@@Type@0@
                                          • String ID: 1connected()$1connectionClosed()$1dtpConnectState(int)$1error(QAbstractSocket::SocketError)$1hostFound()$1readyRead()$1setupSocket()$2connectState(int)$2connected()$2disconnected()$2errorOccurred(QAbstractSocket::SocketError)$2hostFound()$2newConnection()$2readyRead()$QFtpDTP active state server$QFtpPI_socket
                                          • API String ID: 3033387962-3081273582
                                          • Opcode ID: 19b795dba415b7587177cce9741544c74ff2451579a9d8cab30a7d66427c8d6c
                                          • Instruction ID: cd2d9e86c09c2311a3ba4a2c2a21c13814cba131d9dc70cb26dadf52cbc47b72
                                          • Opcode Fuzzy Hash: 19b795dba415b7587177cce9741544c74ff2451579a9d8cab30a7d66427c8d6c
                                          • Instruction Fuzzy Hash: B15159B0104205ABDB00EF51CC9DF9ABBB8FF95344F410419F94697292EB74FA49CBA6
                                          Function 6A668810 Relevance: 75.2, APIs: 50, Instructions: 230timeCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A668430: ??0QCryptographicHash@@QAE@W4Algorithm@0@@Z.QT5CORE(00000000,?,00000000,6BB6B980,?), ref: 6A668451
                                            • Part of subcall function 6A668430: ?begin@QByteArray@@QAEPADXZ.QT5CORE ref: 6A668477
                                            • Part of subcall function 6A668430: ?addData@QCryptographicHash@@QAEXPBDH@Z.QT5CORE(00000000,00000000), ref: 6A668483
                                            • Part of subcall function 6A668430: ?result@QCryptographicHash@@QBE?AVQByteArray@@XZ.QT5CORE(?), ref: 6A668492
                                            • Part of subcall function 6A668430: ?toUpper@QString@@QGBE?AV1@XZ.QT5CORE(?), ref: 6A6684B3
                                            • Part of subcall function 6A668430: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000000), ref: 6A6684CC
                                            • Part of subcall function 6A668430: ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(00000000), ref: 6A6684D7
                                            • Part of subcall function 6A668430: ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6684E1
                                            • Part of subcall function 6A668430: ??1QString@@QAE@XZ.QT5CORE ref: 6A6684EB
                                            • Part of subcall function 6A668430: ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6684F5
                                            • Part of subcall function 6A668430: ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A668515
                                            • Part of subcall function 6A668430: ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A66851F
                                            • Part of subcall function 6A668430: ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A668529
                                            • Part of subcall function 6A668430: ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A668533
                                            • Part of subcall function 6A668430: ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A66853D
                                            • Part of subcall function 6A668430: ??1QCryptographicHash@@QAE@XZ.QT5CORE ref: 6A668547
                                            • Part of subcall function 6A668430: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,00000000,6BB6B980,?), ref: 6A668553
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,6BB6B980,?), ref: 6A668830
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A66883A
                                          • ??0QDataStream@@QAE@PAVQByteArray@@V?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z.QT5CORE(?), ref: 6A668852
                                          • ?setByteOrder@QDataStream@@QAEXW4ByteOrder@1@@Z.QT5CORE(00000001), ref: 6A668864
                                          • ??6QDataStream@@QAEAAV0@_N@Z.QT5CORE(00000001), ref: 6A668872
                                          • ??6QDataStream@@QAEAAV0@_N@Z.QT5CORE(00000001), ref: 6A66887A
                                          • ??0QByteArray@@QAE@HD@Z.QT5CORE(00000006,00000000), ref: 6A668884
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A668895
                                          • ?writeRawData@QDataStream@@QAEHPBDH@Z.QT5CORE(00000000,00000000), ref: 6A6688A7
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6688AD
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6688C6
                                          • ??0QDataStream@@QAE@ABVQByteArray@@@Z.QT5CORE(?), ref: 6A6688D4
                                          • ?setByteOrder@QDataStream@@QAEXW4ByteOrder@1@@Z.QT5CORE(00000001), ref: 6A6688E0
                                          • ??5QDataStream@@QAEAAV0@AAF@Z.QT5CORE(?), ref: 6A6688F1
                                          • ??5QDataStream@@QAEAAV0@AAF@Z.QT5CORE(?), ref: 6A6688FC
                                          • ?skipRawData@QDataStream@@QAEHH@Z.QT5CORE(?), ref: 6A668920
                                          • ??5QDataStream@@QAEAAV0@AAF@Z.QT5CORE(?), ref: 6A66892B
                                          • ??5QDataStream@@QAEAAV0@AAF@Z.QT5CORE(?), ref: 6A668936
                                          • ?resize@QByteArray@@QAEXH@Z.QT5CORE(?), ref: 6A668948
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE ref: 6A668957
                                          • ?readRawData@QDataStream@@QAEHPADH@Z.QT5CORE(00000000,?), ref: 6A668963
                                          • ??1QDataStream@@QAE@XZ.QT5CORE ref: 6A66896D
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(?), ref: 6A66897C
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A668986
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A66899B
                                          • ?writeRawData@QDataStream@@QAEHPBDH@Z.QT5CORE(00000000,00000000), ref: 6A6689A7
                                          • ?currentSecsSinceEpoch@QDateTime@@SA_JXZ.QT5CORE ref: 6A6689AB
                                          • ??6QDataStream@@QAEAAV0@_J@Z.QT5CORE(-B6109100), ref: 6A6689D3
                                          • ?right@QByteArray@@QBE?AV1@H@Z.QT5CORE(?,00000008), ref: 6A6689E7
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A6689F8
                                          • ?writeRawData@QDataStream@@QAEHPBDH@Z.QT5CORE(00000000,00000000), ref: 6A668A04
                                          • ??0QByteArray@@QAE@HD@Z.QT5CORE(00000004,00000000), ref: 6A668A14
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A668A21
                                          • ?writeRawData@QDataStream@@QAEHPBDH@Z.QT5CORE(00000000,00000000), ref: 6A668A2D
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A668A3F
                                          • ?writeRawData@QDataStream@@QAEHPBDH@Z.QT5CORE(00000000,00000000), ref: 6A668A4B
                                          • ??0QByteArray@@QAE@HD@Z.QT5CORE(00000004,00000000), ref: 6A668A55
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A668A62
                                          • ?writeRawData@QDataStream@@QAEHPBDH@Z.QT5CORE(00000000,00000000), ref: 6A668A6E
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(?,00000008), ref: 6A668A7A
                                          • ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(?), ref: 6A668A8F
                                          • ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(?), ref: 6A668AB2
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A668AB8
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A668AC2
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A668ACC
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A668AD6
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A668AE0
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A668AEA
                                          • ??1QDataStream@@QAE@XZ.QT5CORE ref: 6A668AF4
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A668AFE
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$Array@@$DataStream@@$String@@$Data@$?data@?writeChar@@$CryptographicHash@@V0@@$?append@DateTime@@V0@_V1@@$?begin@?setOrder@Order@1@@V0@$$$?add?current?read?resize@?result@?right@?skipAlgorithm@0@@Array@@@Device@@@@@Epoch@Flag@Flags@ModeOpenSecsSinceUpper@
                                          • String ID:
                                          • API String ID: 3612895107-0
                                          • Opcode ID: 1d25f8c90d5058d33bd18eadb13276a0f40f31953b08edcb296ed452695c8efb
                                          • Instruction ID: 66c364557a81ca09b578fec536b4657e52126f432906d61d4ffbc4430cd50304
                                          • Opcode Fuzzy Hash: 1d25f8c90d5058d33bd18eadb13276a0f40f31953b08edcb296ed452695c8efb
                                          • Instruction Fuzzy Hash: 299129B24042069FCB04DF61C858AAABBF8FF95305F015919F597D31A0EB70AE49CF92
                                          Function 6A688840 Relevance: 73.8, APIs: 38, Strings: 4, Instructions: 256networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QNetworkProxyQuery@@QAE@XZ.QT5NETWORK ref: 6A68885B
                                          • ?user@QAuthenticator@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A688882
                                            • Part of subcall function 6A6699D0: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE ref: 6A6699E1
                                            • Part of subcall function 6A6699D0: ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A6699EA
                                            • Part of subcall function 6A6699D0: ??1QString@@QAE@XZ.QT5CORE ref: 6A6699F4
                                          • ?user@QNetworkProxy@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A68889D
                                            • Part of subcall function 6A6683D0: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE ref: 6A6683E4
                                            • Part of subcall function 6A6683D0: ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A6683ED
                                            • Part of subcall function 6A6683D0: ??1QString@@QAE@XZ.QT5CORE ref: 6A6683F7
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6888C2
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6888CF
                                          • ?user@QAuthenticator@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A688900
                                          • ?setUser@QNetworkProxy@@QAEXABVQString@@@Z.QT5NETWORK(00000000), ref: 6A688909
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A688912
                                          • ?user@QNetworkProxy@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A688921
                                          • ?setPassword@QNetworkProxy@@QAEXABVQString@@@Z.QT5NETWORK(00000000), ref: 6A68892A
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A688933
                                          • ?password@QNetworkProxy@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A688951
                                          • ?user@QNetworkProxy@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A688962
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A688972
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A68897B
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(00000000), ref: 6A68898B
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A688994
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6889A6
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6889B0
                                          • ?blockSignals@QObject@@QAE_N_N@Z.QT5CORE(00000001), ref: 6A6889C9
                                          • ?abort@QAbstractSocket@@QAEXXZ.QT5NETWORK ref: 6A6889D9
                                          • ?abort@QAbstractSocket@@QAEXXZ.QT5NETWORK ref: 6A6889E5
                                          • ?blockSignals@QObject@@QAE_N_N@Z.QT5CORE(00000000), ref: 6A6889F9
                                          • ?port@QNetworkProxy@@QBEGXZ.QT5NETWORK ref: 6A688A08
                                          • ?hostName@QNetworkProxy@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A688A19
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000002,?), ref: 6A688A33
                                          • ??1QAuthenticator@@QAE@XZ.QT5NETWORK(?,00000002,?), ref: 6A688A3D
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A688A4D
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Proxy authentication failed,00000000,000000FF), ref: 6A688A7A
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Proxy authentication failed: %1,00000000,000000FF), ref: 6A688A90
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(00000020), ref: 6A688AA5
                                          • ?arg@QString@@QBE?AV1@ABV1@HVQChar@@@Z.QT5CORE(00000020,00000000,00000000), ref: 6A688AB7
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A688AD7
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A688AE6
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A688AF5
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A688B0F
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(00000000,_q_emitPendingConnectionNotification,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6A688B5C
                                          • ??1QAuthenticator@@QAE@XZ.QT5NETWORK ref: 6A688B69
                                          Strings
                                          • _q_emitPendingConnectionNotification, xrefs: 6A688B4D
                                          • Proxy authentication failed: %1, xrefs: 6A688A86
                                          • Proxy authentication failed, xrefs: 6A688A6D
                                          • , xrefs: 6A688A99
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Network$Proxy@@$Object@@V0@@$?user@$Array@@Authenticator@@Byte$Meta$?abort@?block?set?tr@AbstractChar@@@E@$$GenericSignals@Socket@@String@@@$?arg@?host?invoke?password@?port@Argument@@Argument@@444444444@Char@@ConnectionLatin1Method@Name@Password@ProxyQt@@Query@@ReturnType@User@
                                          • String ID: $Proxy authentication failed$Proxy authentication failed: %1$_q_emitPendingConnectionNotification
                                          • API String ID: 3415480879-2777668967
                                          • Opcode ID: 1d742624b374a1e265c19b9d035d88294ba4987591dd65b7d6e64247e858902b
                                          • Instruction ID: fe86d894bb7ae5d113479357e795d007a009dbbf79be6dbf82af461b028e630f
                                          • Opcode Fuzzy Hash: 1d742624b374a1e265c19b9d035d88294ba4987591dd65b7d6e64247e858902b
                                          • Instruction Fuzzy Hash: 5D9146B11043019FE704DF65C898B9ABBF8FF99348F01051DE596972A2DF70E948CBA6
                                          Function 6A65C200 Relevance: 72.1, APIs: 31, Strings: 10, Instructions: 343networkwindowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,6A65BE23,?), ref: 6A65C225
                                          • ?debug@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNetworkReplyImpl: setCachingEnabled(true) called after setCachingEnabled(false),?,?,?,?,?,?,?,?,?,6A65BE23,?,?,?,?), ref: 6A65C231
                                          • ?isValid@QNetworkCacheMetaData@@QBE_NXZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,6A65BE23,?,?,?,?), ref: 6A65C26C
                                          • ?setParent@QObject@@QAEXPAV1@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,6A65BE23,?,?,?,?), ref: 6A65C29C
                                          • ?attributes@QNetworkCacheMetaData@@QBE?AV?$QHash@W4Attribute@QNetworkRequest@@VQVariant@@@@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,6A65BE23,?,?,?,?), ref: 6A65C2AB
                                          • ?toInt@QVariant@@QBEHPA_N@Z.QT5CORE(00000000,?,?), ref: 6A65C2CF
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A65C2E3
                                          • ??0QVariant@@QAE@H@Z.QT5CORE(?), ref: 6A65C303
                                          • ?setAttribute@QNetworkReply@@IAEXW4Attribute@QNetworkRequest@@ABVQVariant@@@Z.QT5NETWORK(00000000,?), ref: 6A65C316
                                          • ??1QVariant@@QAE@XZ.QT5CORE(00000000,?), ref: 6A65C31F
                                          • ?setAttribute@QNetworkReply@@IAEXW4Attribute@QNetworkRequest@@ABVQVariant@@@Z.QT5NETWORK(00000001,00000000,?,00000000), ref: 6A65C341
                                          • ??1QVariant@@QAE@XZ.QT5CORE(00000001,00000000,?,00000000), ref: 6A65C34A
                                          • ??0QVariant@@QAE@_N@Z.QT5CORE(00000001), ref: 6A65C352
                                          • ?setAttribute@QNetworkReply@@IAEXW4Attribute@QNetworkRequest@@ABVQVariant@@@Z.QT5NETWORK(00000006,?), ref: 6A65C361
                                          • ??1QVariant@@QAE@XZ.QT5CORE(00000006,?), ref: 6A65C36A
                                          • ?rawHeaders@QNetworkCacheMetaData@@QBE?AV?$QList@U?$QPair@VQByteArray@@V1@@@@@XZ.QT5NETWORK(?), ref: 6A65C375
                                          • ??0QMutex@@QAE@XZ.QT5CORE(?), ref: 6A65C391
                                          • ?compare@QByteArray@@QBEHPBDW4CaseSensitivity@Qt@@@Z.QT5CORE(location,00000000), ref: 6A65C3C5
                                          • ?fromEncoded@QUrl@@SA?AV1@ABVQByteArray@@W4ParsingMode@1@@Z.QT5CORE(?,-00000004,00000000), ref: 6A65C3DC
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6A65BE23,?,?), ref: 6A65C3EA
                                          • ??1QUrl@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,6A65BE23,?,?,?), ref: 6A65C3F4
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2readyRead(),?,1_q_cacheLoadReadyRead(),00000000,?), ref: 6A65C45F
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A65BE23), ref: 6A65C472
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2readChannelFinished(),?,1_q_cacheLoadReadyRead(),00000000,?,?,?,?,?,?), ref: 6A65C48F
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A65C49C
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(?,_q_metaDataChanged,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6A65C4D6
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(?,_q_cacheLoadReadyRead,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6A65C510
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(?,onRedirected,00000002,00000000,00000000,?,QUrl,?,int,?,int,00000000,00000000,00000000,00000000,00000000), ref: 6A65C597
                                          • ??1QUrl@@QAE@XZ.QT5CORE ref: 6A65C5AB
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,?), ref: 6A65C5F5
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A61A7F0), ref: 6A65C625
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$MetaNetwork$Attribute@Variant@@$Generic$ConnectionData@@Type@$?setConnection@Request@@$?invokeArgument@@Argument@@444444444@Array@@ByteCacheMethod@Qt@@Qt@@@Reply@@ReturnUrl@@Variant@@@$?connect@Logger@@Message$?attributes@?compare@?debug@?dispose@?free_helper@?from?rawCaseData@1@@DateEncoded@HashHash@Headers@Int@ListList@Mode@1@@Mutex@@Node@1@@Pair@Parent@ParsingSensitivity@Time@@V0@$$V0@@V1@@V1@@@@@Valid@Variant@@@@
                                          • String ID: 1_q_cacheLoadReadyRead()$2readChannelFinished()$2readyRead()$QNetworkReplyImpl: setCachingEnabled(true) called after setCachingEnabled(false)$QUrl$_q_cacheLoadReadyRead$_q_metaDataChanged$int$location$onRedirected
                                          • API String ID: 2937174038-794269202
                                          • Opcode ID: 351eb221173fd6d438fd1fecdfd0b00191448d5534d6c5d62c3e5eb749668758
                                          • Instruction ID: 554c1e13fc2e847f1d7e03d0e74674d79980dbf9b8516602dddf4a0cb34105a6
                                          • Opcode Fuzzy Hash: 351eb221173fd6d438fd1fecdfd0b00191448d5534d6c5d62c3e5eb749668758
                                          • Instruction Fuzzy Hash: 5CB14570104340AFDB10DB65C888BAAB7F4EF85708F41491DF99BA72A1EF31B919CB56
                                          Function 6A68A340 Relevance: 71.9, APIs: 28, Strings: 13, Instructions: 156networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setMaxPendingConnections@QLocalServer@@QAEXH@Z.QT5NETWORK(?), ref: 6A68A365
                                          • ??0QTcpSocket@@QAE@PAVQObject@@@Z.QT5NETWORK ref: 6A68A380
                                          • ??0QMutex@@QAE@XZ.QT5CORE ref: 6A68A398
                                          • ??1QUrl@@QAE@XZ.QT5CORE(00000000), ref: 6A68A3AE
                                          • ?property@QObject@@QBE?AVQVariant@@PBD@Z.QT5CORE(?,_q_networkSession), ref: 6A68A3C3
                                          • ?setProperty@QObject@@QAE_NPBDABVQVariant@@@Z.QT5CORE(_q_networkSession,00000000), ref: 6A68A3D1
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A68A3DB
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A68A3E8
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A68A3F4
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A68A400
                                          • ??0QNetworkProxy@@QAE@W4ProxyType@0@ABVQString@@G11@Z.QT5NETWORK(00000002,00000000,00000000,00000000,00000000), ref: 6A68A411
                                          • ?setProxy@QAbstractSocket@@QAEXABVQNetworkProxy@@@Z.QT5NETWORK(?,00000002,00000000,00000000,00000000,00000000), ref: 6A68A41D
                                          • ??1QNetworkProxy@@QAE@XZ.QT5NETWORK(?,00000002,00000000,00000000,00000000,00000000), ref: 6A68A426
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000002,00000000,00000000,00000000,00000000), ref: 6A68A42F
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A68A439
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A68A443
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2connected(),?,1slotSocketConnected(),00000001), ref: 6A68A468
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A68A477
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2disconnected(),?,1slotSocketDisconnected(),00000001), ref: 6A68A48E
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A68A497
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2readyRead(),?,1slotSocketReadNotification(),00000001), ref: 6A68A4AE
                                          Strings
                                          • 1slotSocketReadNotification(), xrefs: 6A68A49B
                                          • 1slotSocketConnected(), xrefs: 6A68A459
                                          • 2disconnected(), xrefs: 6A68A481
                                          • 2connected(), xrefs: 6A68A45F
                                          • 1slotSocketError(QAbstractSocket::SocketError), xrefs: 6A68A4DB
                                          • 2errorOccurred(QAbstractSocket::SocketError), xrefs: 6A68A4E1
                                          • 1slotSocketStateChanged(QAbstractSocket::SocketState), xrefs: 6A68A4FB
                                          • 1slotSocketBytesWritten(), xrefs: 6A68A4BB
                                          • _q_networkSession, xrefs: 6A68A3BB, 6A68A3CA
                                          • 2readyRead(), xrefs: 6A68A4A1
                                          • 2stateChanged(QAbstractSocket::SocketState), xrefs: 6A68A501
                                          • 2bytesWritten(qint64), xrefs: 6A68A4C1
                                          • 1slotSocketDisconnected(), xrefs: 6A68A47B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$String@@$Connection@Meta$?connect@?setConnectionNetworkQt@@@Type@$Proxy@@Socket@@Variant@@$?property@AbstractConnections@G11@LocalMutex@@Object@@@PendingProperty@ProxyProxy@Proxy@@@Server@@Type@0@Url@@Variant@@@
                                          • String ID: 1slotSocketBytesWritten()$1slotSocketConnected()$1slotSocketDisconnected()$1slotSocketError(QAbstractSocket::SocketError)$1slotSocketReadNotification()$1slotSocketStateChanged(QAbstractSocket::SocketState)$2bytesWritten(qint64)$2connected()$2disconnected()$2errorOccurred(QAbstractSocket::SocketError)$2readyRead()$2stateChanged(QAbstractSocket::SocketState)$_q_networkSession
                                          • API String ID: 3833086528-2179671617
                                          • Opcode ID: deeb8e8a4adc7ee90ad5be9609aa75ddad6d4813b9bd4de88bc5a6d22bc52c4e
                                          • Instruction ID: 79426cb4a046b5358be61c4aa9912efc432e05516fa196c5dd3bbf00361062b2
                                          • Opcode Fuzzy Hash: deeb8e8a4adc7ee90ad5be9609aa75ddad6d4813b9bd4de88bc5a6d22bc52c4e
                                          • Instruction Fuzzy Hash: 90518FB1554209ABDF40EF61CC98E5E7BF8FF91704F410858FA4692192EF31B909CB62
                                          Function 6A6722D0 Relevance: 70.2, APIs: 32, Strings: 8, Instructions: 205COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QDebugStateSaver@@QAE@AAVQDebug@@@Z.QT5CORE(?), ref: 6A6722DE
                                          • ?resetFormat@QDebug@@QAEAAV1@XZ.QT5CORE ref: 6A6722E8
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE(Unknown proxy ), ref: 6A67233B
                                          • ??6QDebug@@QAEAAV0@H@Z.QT5CORE(?), ref: 6A672344
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE(DefaultProxy ), ref: 6A672355
                                          • ??6QDebug@@QAEAAV0@D@Z.QT5CORE(00000022), ref: 6A672361
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE ref: 6A672377
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A672382
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A672392
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A67239D
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6723A7
                                          • ??6QDebug@@QAEAAV0@ABVQString@@@Z.QT5CORE(?), ref: 6A6723B4
                                          • ??6QDebug@@QAEAAV0@D@Z.QT5CORE(0000003A), ref: 6A6723BE
                                          • ??6QDebug@@QAEAAV0@G@Z.QT5CORE(00000000), ref: 6A6723D5
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE(6A6CA814), ref: 6A6723E2
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6723EC
                                          • ??1QString@@QAE@XZ.QT5CORE(?), ref: 6A67243A
                                          • ??1QString@@QAE@XZ.QT5CORE(6A7004BC), ref: 6A672462
                                          • ??1QString@@QAE@XZ.QT5CORE(6A7004BC), ref: 6A67248A
                                          • ??1QString@@QAE@XZ.QT5CORE(6A7004BC), ref: 6A6724B2
                                          • ??1QString@@QAE@XZ.QT5CORE(6A7004BC), ref: 6A6724DA
                                          • ??1QString@@QAE@XZ.QT5CORE(6A7004BC), ref: 6A672502
                                          • ??1QString@@QAE@XZ.QT5CORE(00000067), ref: 6A67252A
                                          • ??6QDebug@@QAEAAV0@D@Z.QT5CORE(0000005B), ref: 6A672536
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(00000020), ref: 6A67254B
                                          • ?QStringList_join@QtPrivate@@YA?AVQString@@PBVQStringList@@PBVQChar@@H@Z.QT5CORE(?,?,?,00000001), ref: 6A672562
                                          • ??6QDebug@@QAEAAV0@ABVQString@@@Z.QT5CORE(?), ref: 6A672572
                                          • ??6QDebug@@QAEAAV0@D@Z.QT5CORE(0000005D), ref: 6A67257C
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A672586
                                          • ??0QDebug@@QAE@$$QAV0@@Z.QT5CORE(?), ref: 6A672595
                                          • ??1QDebugStateSaver@@QAE@XZ.QT5CORE ref: 6A6725A8
                                          • ??1QDebug@@QAE@XZ.QT5CORE ref: 6A6725B2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Debug@@$String@@$V0@@$Array@@ByteE@$$$Char@@DebugSaver@@StateStringString@@@$?resetChar@@@Debug@@@Format@Latin1List@@List_join@Private@@
                                          • String ID: $DefaultProxy $FtpCachingProxy $HttpCachingProxy $HttpProxy $NoProxy $Socks5Proxy $Unknown proxy
                                          • API String ID: 882002937-2037577059
                                          • Opcode ID: 6b2301f7fcfa6eff7fe6434860b8f82eb87aacfd4f548e9e3fd7b6a3a27ff479
                                          • Instruction ID: 41ad1d72d0335e9ef1f14e5233ddadb44fabb9ce69f99825272caddaca0cdf6c
                                          • Opcode Fuzzy Hash: 6b2301f7fcfa6eff7fe6434860b8f82eb87aacfd4f548e9e3fd7b6a3a27ff479
                                          • Instruction Fuzzy Hash: 9B814AB1108201DFCB14DF26C99899BB7F8FB95619F01895DF49B92290EF34EE09CB52
                                          Function 6A616BC0 Relevance: 66.7, APIs: 28, Strings: 10, Instructions: 177networkwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,?,?), ref: 6A616BD2
                                          • ?header@QNetworkRequest@@QBE?AVQVariant@@W4KnownHeaders@1@@Z.QT5NETWORK(?,00000000,?,?,?), ref: 6A616BE0
                                            • Part of subcall function 6A6204E0: ??0QVariant@@QAE@ABV0@@Z.QT5CORE(?,?,00000000,00000000,6A61594F,?,00000001,?), ref: 6A620515
                                          • ?isValid@QVariant@@QBE_NXZ.QT5CORE(?,00000000,?,?,?), ref: 6A616BE7
                                          • ??1QVariant@@QAE@XZ.QT5CORE(?,?), ref: 6A616BF3
                                          • ??0QString@@QAE@XZ.QT5CORE(?,?), ref: 6A616C09
                                          • ?reserve@QByteArray@@QAEXH@Z.QT5CORE(?,?,?), ref: 6A616C20
                                          • ?append@QByteArray@@QAEAAV1@PBD@Z.QT5CORE(multipart/,?,?), ref: 6A616C35
                                          • ?append@QByteArray@@QAEAAV1@PBD@Z.QT5CORE(related,?,?), ref: 6A616C6E
                                          • ?reserve@QByteArray@@QAEXH@Z.QT5CORE(?,?,?), ref: 6A616C94
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE(?,?), ref: 6A616CA5
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?), ref: 6A616CC2
                                          • ?cend@QByteArray@@QBEPBDXZ.QT5CORE(?,?), ref: 6A616CCE
                                          • ?resize@QByteArray@@QAEXH@Z.QT5CORE(?,?,?), ref: 6A616CF5
                                          • ??0QVariant@@QAE@ABVQByteArray@@@Z.QT5CORE(?,?,?), ref: 6A616D04
                                          • ?setHeader@QNetworkRequest@@QAEXW4KnownHeaders@1@ABVQVariant@@@Z.QT5NETWORK(00000000,00000000,?,?), ref: 6A616D0F
                                          • ??1QVariant@@QAE@XZ.QT5CORE(00000000,00000000,?,?), ref: 6A616D18
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?), ref: 6A616D22
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(MIME-Version,000000FF,?,?), ref: 6A616D39
                                          • ?hasRawHeader@QNetworkRequest@@QBE_NABVQByteArray@@@Z.QT5NETWORK(?,?,?), ref: 6A616D44
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(1.0,000000FF,?,?,?), ref: 6A616D58
                                          • ?setRawHeader@QNetworkRequest@@QAEXABVQByteArray@@0@Z.QT5NETWORK(00000000,00000000,?,?), ref: 6A616D62
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(00000000,00000000,?,?), ref: 6A616D6B
                                          • ?isReadable@QIODevice@@QBE_NXZ.QT5CORE(?,?,?), ref: 6A616D79
                                          • ?isOpen@QIODevice@@QBE_NXZ.QT5CORE(?,?), ref: 6A616D85
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000,?,?,?), ref: 6A616DAF
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000,?,?), ref: 6A616DC6
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,device is not readable,?,?), ref: 6A616DD2
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?), ref: 6A616DDF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$Array@@$Variant@@$NetworkRequest@@$Header@Logger@@Message$?append@?reserve@?setArray@@@Device@@KnownString@@V0@@$?begin@?cend@?data@?has?header@?resize@?warning@Array@@0@Authenticator@@Char@@Headers@1@Headers@1@@Open@Readable@SharedValid@Variant@@@
                                          • String ID: 1.0$; boundary="$MIME-Version$alternative$could not open device for reading$device is not readable$form-data$mixed$multipart/$related
                                          • API String ID: 3012417587-1383949304
                                          • Opcode ID: 5b57dabd97c53b0769e4b6a0f05c8d4f43605045e07f1a8d067c45be27232316
                                          • Instruction ID: 494466321467d1b8a07ebfeaa2cdc775813941f6b54bdb13bd8512687a092d9c
                                          • Opcode Fuzzy Hash: 5b57dabd97c53b0769e4b6a0f05c8d4f43605045e07f1a8d067c45be27232316
                                          • Instruction Fuzzy Hash: CF613979608241ABCB44DF69C998AAABBF4EF89304F45485DF583D7291DF30EC05CB62
                                          Function 6A632390 Relevance: 65.0, APIs: 32, Strings: 5, Instructions: 229timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?indexOf@QString@@QBEHVQLatin1String@@HW4CaseSensitivity@Qt@@@Z.QT5CORE(00000004,SIZE,00000000,00000001), ref: 6A6323E3
                                          • ?indexOf@QString@@QBEHVQLatin1String@@HW4CaseSensitivity@Qt@@@Z.QT5CORE(00000004,MDTM,00000000,00000001), ref: 6A6323FB
                                          • ?indexOf@QString@@QBEHVQLatin1String@@HW4CaseSensitivity@Qt@@@Z.QT5CORE(00000003,PWD,00000000,00000001), ref: 6A632413
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A632445
                                          • ?indexOf@QString@@QBEHVQChar@@HW4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000000,00000001), ref: 6A632460
                                          • ?lastIndexOf@QString@@QBEHVQChar@@HW4CaseSensitivity@Qt@@@Z.QT5CORE(?,000000FF,00000001,?,00000000,00000001), ref: 6A632474
                                          • ?mid@QString@@QBE?AV1@HH@Z.QT5CORE(00000001,00000001,00000000,?,000000FF,00000001,?,00000000,00000001), ref: 6A63248C
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000,?,000000FF,00000001,?,00000000,00000001), ref: 6A632497
                                          • ??1QString@@QAE@XZ.QT5CORE(?,000000FF,00000001,?,00000000,00000001), ref: 6A6324A1
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?,?,000000FF,00000001,?,00000000,00000001), ref: 6A6324AE
                                          • ?path@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(00000000,?,?,?,000000FF,00000001,?,00000000,00000001), ref: 6A6324D0
                                          • ??1QUrl@@QAE@XZ.QT5CORE(?,?,?,000000FF,00000001,?,00000000,00000001), ref: 6A6324E0
                                          • ?startsWith@QString@@QBE_NABV1@W4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000001,?,?,?,000000FF,00000001,?,00000000,00000001), ref: 6A6324ED
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(0000002F,?,00000001,?,?), ref: 6A632509
                                          • ?endsWith@QString@@QBE_NVQChar@@W4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000001,?,?), ref: 6A632513
                                          • ?chop@QString@@QAEXH@Z.QT5CORE(00000001,?,00000001,?,?), ref: 6A632523
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000001,?,?,00000001,?,?), ref: 6A63253E
                                          • ?append@QString@@QAEAAV1@ABV1@@Z.QT5CORE(00000001,?,00000001,?,?), ref: 6A63254D
                                          • ?setPath@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z.QT5CORE(00000002,00000002,?,00000001,?,?), ref: 6A63255E
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000001,?,?), ref: 6A632568
                                          • ??1QUrl@@QAE@XZ.QT5CORE(?,?,00000001,?,?), ref: 6A63257E
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,000000FF,00000001,?,00000000,00000001), ref: 6A632584
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,000000FF,00000001,?,00000000,00000001), ref: 6A63258E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$CaseQt@@@Sensitivity@$?indexChar@@Latin1Url@@$V0@@$With@$?append@?chop@?ends?last?mid@?path@?set?startsArray@@ByteChar@@@ComponentDateFlags@FormattingIndexMode@1@@Option@ParsingPath@Time@@Url@@@@@V0@$$V1@@
                                          • String ID: /$MDTM$PWD$SIZE$yyyyMMddHHmmss
                                          • API String ID: 1084111040-2544633063
                                          • Opcode ID: f03ab682888f74b535bf14d93c5d09f582e2338927c8b7d8820d04343e77c5af
                                          • Instruction ID: 7a56803227543128282d8fd5b18daa3be1d3336bad5658a5e4667f2a21c15802
                                          • Opcode Fuzzy Hash: f03ab682888f74b535bf14d93c5d09f582e2338927c8b7d8820d04343e77c5af
                                          • Instruction Fuzzy Hash: 9B819DB1204201ABDB54DB61C898FAEBBF8EF95715F01192DF147D21E0DE70A94ACB92
                                          Function 6A614B60 Relevance: 64.8, APIs: 43, Instructions: 277networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isEmpty@QUrl@@QBE_NXZ.QT5CORE ref: 6A614BAC
                                          • ??9QUrl@@QBE_NABV0@@Z.QT5CORE(00000000), ref: 6A614BB9
                                          • ?userName@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A614BD7
                                          • ?password@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A614BFE
                                          • ?user@QAuthenticator@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A614C18
                                          • ?userName@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A614C2F
                                          • ??8@YA_NABVQString@@0@Z.QT5CORE(00000000,00000000), ref: 6A614C3C
                                          • ?user@QNetworkProxy@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A614C50
                                          • ?password@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A614C67
                                          • ??8@YA_NABVQString@@0@Z.QT5CORE(00000000,00000000), ref: 6A614C74
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A614C99
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A614CAB
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A614CBD
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A614CCF
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A614CE1
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A614CEE
                                          • ?userName@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A614D0B
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A614D1D
                                          • ?password@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A614D33
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A614D45
                                          • ??4QUrl@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A614D50
                                          • ?setPassword@QAuthenticator@@QAEXABVQString@@@Z.QT5NETWORK(00000000), ref: 6A614D3C
                                            • Part of subcall function 6A669860: ??8@YA_NABVQString@@0@Z.QT5CORE(?,?), ref: 6A669871
                                            • Part of subcall function 6A669860: ?detach@QAuthenticator@@QAEXXZ.QT5NETWORK ref: 6A669880
                                            • Part of subcall function 6A669860: ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A66988E
                                          • ?setUser@QAuthenticator@@QAEXABVQString@@@Z.QT5NETWORK(00000000), ref: 6A614D14
                                            • Part of subcall function 6A6698E0: ??8@YA_NABVQString@@0@Z.QT5CORE(?,?), ref: 6A6698EE
                                            • Part of subcall function 6A6698E0: ?detach@QAuthenticator@@QAEXXZ.QT5NETWORK ref: 6A6698FD
                                            • Part of subcall function 6A6698E0: ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A669908
                                          • ??4QUrl@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A614E98
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(?,?,00000001,?), ref: 6A614ED2
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Url@@$ComponentFlags@FormattingOption@Url@@@@@$Authenticator@@V0@@$??8@String@@0@$?password@?userName@$?detach@?set?user@Object@@String@@@$?activate@Empty@MetaNetworkPassword@Proxy@@User@
                                          • String ID:
                                          • API String ID: 4206525496-0
                                          • Opcode ID: 98b1b943fa31984f6b50b6af363242c74a0872621e4bee9d1b9a4945bc4a3531
                                          • Instruction ID: 900b75e00728d8bb8d63c15e35f1151c0e6cc2783711f30318874af93e45f0ce
                                          • Opcode Fuzzy Hash: 98b1b943fa31984f6b50b6af363242c74a0872621e4bee9d1b9a4945bc4a3531
                                          • Instruction Fuzzy Hash: 75B150B12083009FDB00DF69C998B9ABBF8AF86349F45091DF596C3291DF71AD09CB56
                                          Function 6A630330 Relevance: 63.2, APIs: 34, Strings: 2, Instructions: 238timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?readLine@QIODevice@@QAE?AVQByteArray@@_J@Z.QT5CORE(?,00000000,00000000,?,?,?), ref: 6A630381
                                          • ?fromUtf8@QString@@SA?AV1@ABVQByteArray@@@Z.QT5CORE(00000000,00000000,?,?,?), ref: 6A63038D
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?), ref: 6A63039A
                                          • ?at@QString@@QBE?BVQChar@@H@Z.QT5CORE(?,00000000), ref: 6A6303FC
                                          • ?digitValue@QChar@@SIHI@Z.QT5CORE ref: 6A630405
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(00000004,?), ref: 6A630467
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A630476
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(0000002D), ref: 6A630488
                                          • ??AQString@@QAE?AVQCharRef@@H@Z.QT5CORE(?,00000003), ref: 6A630499
                                          • ??4QCharRef@@QAEAAV0@VQChar@@@Z.QT5CORE ref: 6A6304A1
                                          • ?leftRef@QString@@QBE?AVQStringRef@@H@Z.QT5CORE(?,00000004), ref: 6A6304B2
                                          • ?compare@QString@@QBEHABVQStringRef@@W4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000001), ref: 6A6304C3
                                          • ??8@YA_NABVQString@@ABVQStringRef@@@Z.QT5CORE(?,?), ref: 6A6304DB
                                          • ?midRef@QString@@QBE?AVQStringRef@@HH@Z.QT5CORE(?,00000004,000000FF), ref: 6A6304F5
                                          • ?append@QString@@QAEAAV1@ABVQStringRef@@@Z.QT5CORE(00000000), ref: 6A6304FA
                                          • ?append@QString@@QAEAAV1@ABV1@@Z.QT5CORE(?), ref: 6A630505
                                          • ?readLine@QIODevice@@QAE?AVQByteArray@@_J@Z.QT5CORE(?,00000000,00000000), ref: 6A630527
                                          • ?fromUtf8@QString@@SA?AV1@ABVQByteArray@@@Z.QT5CORE(?,00000000), ref: 6A630533
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A630541
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A63054B
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A630555
                                          • ?leftRef@QString@@QBE?AVQStringRef@@H@Z.QT5CORE(?,00000004), ref: 6A630566
                                          • ?compare@QString@@QBEHABVQStringRef@@W4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000001), ref: 6A63058B
                                          • ?midRef@QString@@QBE?AVQStringRef@@HH@Z.QT5CORE(?,00000004,000000FF), ref: 6A6305A6
                                          • ?append@QString@@QAEAAV1@ABVQStringRef@@@Z.QT5CORE(00000000), ref: 6A6305AB
                                          • ?endsWith@QString@@QBE_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z.QT5CORE(00000002,6A6C45D0,00000001), ref: 6A6305B8
                                          • ?chop@QString@@QAEXH@Z.QT5CORE(00000002), ref: 6A6305C6
                                          • ??4QString@@QAEAAV0@VQLatin1String@@@Z.QT5CORE(00000000,6A6C4469), ref: 6A6305E2
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6305EC
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6305F6
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A630600
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A63062E
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A630638
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A630642
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$String$Ref@@$Byte$Latin1Ref@$?append@Array@@CaseChar@@Qt@@@Ref@@@Sensitivity@$?compare@?from?left?mid?readArray@@@Array@@_CharChar@@@Device@@Line@String@@@Utf8@V0@@$??8@?at@?chop@?digit?endsDateTime@@V0@$$V1@@Value@With@
                                          • String ID: $-
                                          • API String ID: 740422422-1933255201
                                          • Opcode ID: 76d489847c14f375a8b1aeb2d1a11e666dca4d0e0b8ee4977ac7e90fd5fbd1d2
                                          • Instruction ID: 89c70f56d1d8b8a1144bc03f9f6743a647c59a25538d6dd77e1562f9a1cec503
                                          • Opcode Fuzzy Hash: 76d489847c14f375a8b1aeb2d1a11e666dca4d0e0b8ee4977ac7e90fd5fbd1d2
                                          • Instruction Fuzzy Hash: 5D913AB12083019FDB04DF65C898A9EBBF8AF89305F01482DF196D7291DF70EA09CB52
                                          Function 6A6AA380 Relevance: 61.4, APIs: 32, Strings: 3, Instructions: 199windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,00000000,6A6934ED,?,00000001), ref: 6A6AA394
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6AA3C6
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(?,?,?,?), ref: 6A6AA3AD
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocketBackendPrivate::X509_to_QByteArray: null X509), ref: 6A6AA3B9
                                          • ??0QString@@QAE@XZ.QT5CORE(?,?,00000000,6A6934ED,?,00000001), ref: 6A6AA3E7
                                          • ?resize@QByteArray@@QAEXH@Z.QT5CORE(00000000), ref: 6A6AA3F2
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE ref: 6A6AA3FC
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6AA41C
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6AA426
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(?), ref: 6A6AA446
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6AA450
                                          • ?toBase64@QByteArray@@QBE?AV1@XZ.QT5CORE(?,00000000,00000000), ref: 6A6AA46B
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A6AA476
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6AA480
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6AA48A
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE(00000040), ref: 6A6AA4B6
                                          • ?fromRawData@QByteArray@@SA?AV1@PBDH@Z.QT5CORE(?,00000000), ref: 6A6AA4C4
                                          • ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(00000000), ref: 6A6AA4CE
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6AA4D4
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(0000000A), ref: 6A6AA4E0
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE(?), ref: 6A6AA50E
                                          • ?fromRawData@QByteArray@@SA?AV1@PBDH@Z.QT5CORE(?,00000000), ref: 6A6AA51E
                                          • ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(00000000), ref: 6A6AA528
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6AA52E
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(0000000A), ref: 6A6AA53A
                                          • ??0QByteArray@@QAE@HW4Initialization@Qt@@@Z.QT5CORE(?,00000000), ref: 6A6AA553
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A6AA55B
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A6AA57E
                                          • ?cend@QByteArray@@QBEPBDXZ.QT5CORE ref: 6A6AA58A
                                          Strings
                                          • QSslSocketBackendPrivate::X509_to_QByteArray: null X509, xrefs: 6A6AA3B3
                                          • -----END CERTIFICATE-----, xrefs: 6A6AA59E
                                          • -----BEGIN CERTIFICATE-----, xrefs: 6A6AA563
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$String@@$?append@$?begin@$?data@?fromCategory@@Char@@Data@Logger@@LoggingMessageV0@@V1@@$?cend@?resize@?warning@Base64@DateE@$$Enabled@H00@Init_thread_footerInitialization@Qt@@@Time@@V0@$$Warning
                                          • String ID: -----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$QSslSocketBackendPrivate::X509_to_QByteArray: null X509
                                          • API String ID: 3885578758-744782163
                                          • Opcode ID: ad080246fc715710f10f08aa5aed4837ce3d6e76333d4eb45e7a07126d97314a
                                          • Instruction ID: d00aafab9e2695d539bbf2aadacbe2a45ad2f3ffa9d8636161289aaf06a7f028
                                          • Opcode Fuzzy Hash: ad080246fc715710f10f08aa5aed4837ce3d6e76333d4eb45e7a07126d97314a
                                          • Instruction Fuzzy Hash: 05615DB25042019FCB04DF65C89899EBBF8FF99215F46481DF997C3251EB30AD49CB92
                                          Function 6A622BC0 Relevance: 59.9, APIs: 26, Strings: 8, Instructions: 436windowtimenetworkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2readyRead(),?,1_q_bufferOutgoingData(),00000000,00000000), ref: 6A622CAC
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A622CBB
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2readChannelFinished(),?,1_q_bufferOutgoingDataFinished(),00000000), ref: 6A622CDC
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A622CE5
                                          • ?reserve@QRingBuffer@@QAEPAD_J@Z.QT5CORE(00000000), ref: 6A622D22
                                          • ?read@QIODevice@@QAE_JPAD_J@Z.QT5CORE(00000000,00000000), ref: 6A622D35
                                          • ??0QString@@QAE@XZ.QT5CORE(?), ref: 6A622ED0
                                          • ?errorString@QNetworkSession@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A622EE3
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A622F07
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A622F11
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A622F2D
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNetworkReplyImplPrivate::error: Internal problem, this method must only be called once.), ref: 6A622F39
                                          • ??1QString@@QAE@XZ.QT5CORE(00000008), ref: 6A622F6F
                                          • ?translate@QCoreApplication@@SA?AVQString@@PBD00H@Z.QT5CORE(?,QNetworkReply,Network session error.,00000000,000000FF), ref: 6A622FF1
                                          • ??1QString@@QAE@XZ.QT5CORE(00000008,00000000), ref: 6A623008
                                          • ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(00000000,2readyRead(),?,1_q_bufferOutgoingData(),00000000,00000000,?,?), ref: 6A623931
                                          • ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(00000000,2readChannelFinished(),?,1_q_bufferOutgoingDataFinished(),?,?), ref: 6A623948
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(?,_q_startOperation,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6A623982
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$String@@$Meta$Connection@$ConnectionType@$?connect@?disconnect@D01@GenericLogger@@MessageQt@@@$?error?invoke?read@?reserve@?translate@?warning@Application@@Argument@@Argument@@444444444@Buffer@@CoreDateDevice@@Method@NetworkQt@@ReturnRingSession@@String@Time@@V0@$$V0@@
                                          • String ID: 1_q_bufferOutgoingData()$1_q_bufferOutgoingDataFinished()$2readChannelFinished()$2readyRead()$Network session error.$QNetworkReply$QNetworkReplyImplPrivate::error: Internal problem, this method must only be called once.$_q_startOperation
                                          • API String ID: 2142794806-2140638082
                                          • Opcode ID: 7fffd466a319c549415a6ea0edd753e26184887654cabfb438809fb6b4cacf43
                                          • Instruction ID: 452e104b094a035d5719ca26a946a528b91bdc366fe332a671efcc57a39f31f5
                                          • Opcode Fuzzy Hash: 7fffd466a319c549415a6ea0edd753e26184887654cabfb438809fb6b4cacf43
                                          • Instruction Fuzzy Hash: 9EE17931614200ABDB14DB68C884B9AB7F5EF86714F454959FA9A972A0DF31EC01CF92
                                          Function 6A634B20 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 208networkwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?url@QNetworkCacheMetaData@@QBE?AVQUrl@@XZ.QT5NETWORK(?,?,?,?,?,6A633F2B,?,?,00000000), ref: 6A634B37
                                            • Part of subcall function 6A6286A0: ??0QUrl@@QAE@ABV0@@Z.QT5CORE ref: 6A6286AA
                                            • Part of subcall function 6A633180: ?isValid@QUrl@@QBE_NXZ.QT5CORE(?,?,?,6A63357C,?,?), ref: 6A63318B
                                            • Part of subcall function 6A633180: ??0QString@@QAE@XZ.QT5CORE ref: 6A633199
                                          • ??1QUrl@@QAE@XZ.QT5CORE(?,00000000,?,?,?,?,6A633F2B,?,?,00000000), ref: 6A634B53
                                          • ?exists@QFile@@SA_NABVQString@@@Z.QT5CORE(?,?,?,?,6A633F2B,?,?,00000000), ref: 6A634B5A
                                          • ?remove@QFile@@SA_NABVQString@@@Z.QT5CORE(?,?,6A633F2B,?,?,00000000), ref: 6A634B6C
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000,?,?,6A633F2B,?,?,00000000), ref: 6A634B83
                                          • ?warning@QMessageLogger@@QBE?AVQDebug@@XZ.QT5CORE(?,?,?,6A633F2B,?,?,00000000), ref: 6A634B90
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE(QNetworkDiskCache: couldn't remove the cache file ,?,?,6A633F2B,?,?,00000000), ref: 6A634B9D
                                          • ??6QDebug@@QAEAAV0@ABVQString@@@Z.QT5CORE(?,?,?,6A633F2B,?,?,00000000), ref: 6A634BAA
                                          • ??1QDebug@@QAE@XZ.QT5CORE(?,?,6A633F2B,?,?,00000000), ref: 6A634BB4
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,6A633F2B,?,?,00000000), ref: 6A634BBE
                                          • ??0QTemporaryFile@@QAE@ABVQString@@PAVQObject@@@Z.QT5CORE(?,?,?,?,6A633F2B,?,?,00000000), ref: 6A634C38
                                          • ?open@QTemporaryFile@@QAE_NXZ.QT5CORE(?,?,6A633F2B,?,?,00000000), ref: 6A634C49
                                          • ??0QDataStream@@QAE@PAVQIODevice@@@Z.QT5CORE(?,?,?,?,6A633F2B,?,?,00000000), ref: 6A634C64
                                          • ?data@QBuffer@@QBEABVQByteArray@@XZ.QT5CORE(?,?,6A633F2B,?,?,00000000), ref: 6A634C6C
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,6A633F2B,?,?,00000000), ref: 6A634C79
                                          • ?qCompress@@YA?AVQByteArray@@PBEHH@Z.QT5CORE(?,00000000,?,000000FF,?,?,6A633F2B,?,?,00000000), ref: 6A634C88
                                          • ??6@YAAAVQDataStream@@AAV0@ABVQByteArray@@@Z.QT5CORE(?,?,?,?,6A633F2B,?,?,00000000), ref: 6A634C98
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A634CA5
                                          • ??1QDataStream@@QAE@XZ.QT5CORE ref: 6A634CAF
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,6A633F2B,?,?,00000000), ref: 6A634CB9
                                          • ?isOpen@QIODevice@@QBE_NXZ.QT5CORE(?,?,6A633F2B,?,?,00000000), ref: 6A634CCC
                                          • ?error@QFileDevice@@QBE?AW4FileError@1@XZ.QT5CORE(?,?,6A633F2B,?,?,00000000), ref: 6A634CD9
                                          • ?setAutoRemove@QTemporaryFile@@QAEX_N@Z.QT5CORE(00000000), ref: 6A634CED
                                          • ?rename@QTemporaryFile@@QAE_NABVQString@@@Z.QT5CORE(?), ref: 6A634CF7
                                          • ?url@QNetworkCacheMetaData@@QBE?AVQUrl@@XZ.QT5NETWORK(?), ref: 6A634D1E
                                          • ?url@QNetworkCacheMetaData@@QBE?AVQUrl@@XZ.QT5NETWORK(00000000), ref: 6A634D2D
                                          • ??8QUrl@@QBE_NABV0@@Z.QT5CORE(00000000), ref: 6A634D35
                                          • ??1QUrl@@QAE@XZ.QT5CORE ref: 6A634D41
                                          • ??1QUrl@@QAE@XZ.QT5CORE ref: 6A634D47
                                          • ??0QNetworkCacheMetaData@@QAE@XZ.QT5NETWORK ref: 6A634D51
                                          • ??1QNetworkCacheMetaData@@QAE@XZ.QT5NETWORK ref: 6A634D64
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A634D8B
                                          Strings
                                          • QNetworkDiskCache: couldn't remove the cache file , xrefs: 6A634B96
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Url@@$File@@String@@$CacheData@@MetaNetwork$ByteDebug@@String@@@Temporary$?url@Array@@DataStream@@$?data@Device@@FileLogger@@MessageV0@@$??6@?error@?exists@?open@?remove@?rename@?set?warning@Array@@@AutoBuffer@@Char@@Compress@@Device@@@Error@1@Object@@@Open@Remove@Valid@
                                          • String ID: QNetworkDiskCache: couldn't remove the cache file
                                          • API String ID: 877016995-3636651760
                                          • Opcode ID: db286cc7bf98fc9e447bdf3c947414257f88e0082d6e5ed5a41e7a2dd924f7ab
                                          • Instruction ID: 22cb3a804089f7d240d37a88b950d384a3682e49cd61965312996c9cd3e50630
                                          • Opcode Fuzzy Hash: db286cc7bf98fc9e447bdf3c947414257f88e0082d6e5ed5a41e7a2dd924f7ab
                                          • Instruction Fuzzy Hash: 3B815BB06002169FCB48DF61C998A9AB7F8FF8531AF014429E847C7291DF31ED09CBA1
                                          Function 6A62A830 Relevance: 59.6, APIs: 22, Strings: 12, Instructions: 138timeCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QObjectPrivate@@QAE@H@Z.QT5CORE(00050F02), ref: 6A62A851
                                            • Part of subcall function 6A62AA10: ??0QObject@@QAE@PAV0@@Z.QT5CORE(00000000,?,00000000,?,?,00000030,6A62A867,00000000), ref: 6A62AA25
                                            • Part of subcall function 6A62AA10: ??0QObject@@QAE@PAV0@@Z.QT5CORE ref: 6A62AA3A
                                            • Part of subcall function 6A62AA10: ??0QTcpServer@@QAE@PAVQObject@@@Z.QT5NETWORK(00000040), ref: 6A62AA4F
                                            • Part of subcall function 6A62AA10: ??0QString@@QAE@XZ.QT5CORE(00000040), ref: 6A62AA5A
                                            • Part of subcall function 6A62AA10: ??0QString@@QAE@XZ.QT5CORE ref: 6A62AA67
                                            • Part of subcall function 6A62AA10: ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(0000001B,QFtpDTP active state server), ref: 6A62AA83
                                            • Part of subcall function 6A62AA10: ?setObjectName@QObject@@QAEXABVQString@@@Z.QT5CORE(00000000), ref: 6A62AA96
                                            • Part of subcall function 6A62AA10: ??1QString@@QAE@XZ.QT5CORE ref: 6A62AA9C
                                            • Part of subcall function 6A62AA10: ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(00000000,0000004C,2newConnection(),00000040,1setupSocket(),00000000), ref: 6A62AABB
                                            • Part of subcall function 6A62AA10: ??1Connection@QMetaObject@@QAE@XZ.QT5CORE(00000000), ref: 6A62AACA
                                            • Part of subcall function 6A62AA10: ??0QTcpSocket@@QAE@PAVQObject@@@Z.QT5NETWORK(00000000), ref: 6A62AAD7
                                            • Part of subcall function 6A62AA10: ??0QString@@QAE@XZ.QT5CORE(00000000), ref: 6A62AAE3
                                            • Part of subcall function 6A62AA10: ??0QString@@QAE@XZ.QT5CORE ref: 6A62AB06
                                            • Part of subcall function 6A62AA10: ??0QString@@QAE@XZ.QT5CORE ref: 6A62AB19
                                            • Part of subcall function 6A62AA10: ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(0000000D,QFtpPI_socket), ref: 6A62AB2A
                                            • Part of subcall function 6A62AA10: ?setObjectName@QObject@@QAEXABVQString@@@Z.QT5CORE(?), ref: 6A62AB37
                                            • Part of subcall function 6A62AA10: ??1QString@@QAE@XZ.QT5CORE ref: 6A62AB3D
                                            • Part of subcall function 6A62AA10: ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2hostFound(),?,1hostFound(),00000000), ref: 6A62AB5A
                                            • Part of subcall function 6A62AA10: ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62AB63
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A62A89E
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A62A8AA
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A62A8B6
                                          • ??0QObject@@IAE@AAVQObjectPrivate@@PAV0@@Z.QT5CORE(00000000,?), ref: 6A62A8C3
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Unknown error,00000000,000000FF), ref: 6A62A8E5
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(?), ref: 6A62A8F6
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A62A900
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2connectState(int),?,1_q_piConnectState(int),00000000), ref: 6A62A922
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE(?,?,?,?,?,00000000), ref: 6A62A931
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2finished(QString),?,1_q_piFinished(QString),00000000,?,?,?,?,?,00000000), ref: 6A62A949
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62A952
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2error(int,QString),?,1_q_piError(int,QString),00000000), ref: 6A62A96A
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62A973
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2rawFtpReply(int,QString),?,1_q_piFtpReply(int,QString),00000000), ref: 6A62A98B
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62A994
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2readyRead(),?,2readyRead(),00000000), ref: 6A62A9B0
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62A9B9
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2dataTransferProgress(qint64,qint64),?,2dataTransferProgress(qint64,qint64),00000000), ref: 6A62A9CE
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62A9D7
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2listInfo(QUrlInfo),?,2listInfo(QUrlInfo),00000000), ref: 6A62A9EC
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62A9F5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$Meta$Connection@$String@@$?connect@ConnectionQt@@@Type@$ObjectString@@@V0@@$?setLatin1Name@Object@@@Private@@$?tr@DateServer@@Socket@@Time@@V0@$$malloc
                                          • String ID: 1_q_piConnectState(int)$1_q_piError(int,QString)$1_q_piFinished(QString)$1_q_piFtpReply(int,QString)$2connectState(int)$2dataTransferProgress(qint64,qint64)$2error(int,QString)$2finished(QString)$2listInfo(QUrlInfo)$2rawFtpReply(int,QString)$2readyRead()$Unknown error
                                          • API String ID: 3613037015-681322675
                                          • Opcode ID: 52ca9047b85df03b6a3c09efe1fa0d7457ae71950bdb3ee70d3da3d11e93a6d6
                                          • Instruction ID: 5b7759603671383effe32ebf4f2286a0861b4b8776990282dcbcb6e8fe81d114
                                          • Opcode Fuzzy Hash: 52ca9047b85df03b6a3c09efe1fa0d7457ae71950bdb3ee70d3da3d11e93a6d6
                                          • Instruction Fuzzy Hash: C2415E71104305ABDB10DF61CC8DF9BBBB8EF56394F010818F64692191EB70BA59CBA6
                                          Function 6A686390 Relevance: 58.0, APIs: 27, Strings: 6, Instructions: 295windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A68643A
                                          • ?append@QRingBuffer@@QAEXABVQByteArray@@@Z.QT5CORE(?), ref: 6A686465
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A686476
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68649E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSocks5SocketEnginePrivate::_q_controlSocketReadNotification: Unexpectedly received data while in state=%d and mode=%d,?,?), ref: 6A6864B0
                                          • ?read@QIODevice@@QAE?AVQByteArray@@_J@Z.QT5CORE(?,00000002,00000000), ref: 6A687E55
                                          • ?at@QByteArray@@QBEDH@Z.QT5CORE(00000000), ref: 6A687E61
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A687E6F
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,SOCKS version 5 protocol error,00000000,000000FF), ref: 6A687E8B
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A687EA3
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A687EBD
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A688067
                                          Strings
                                          • , xrefs: 6A687FF8
                                          • SOCKS version 5 protocol error, xrefs: 6A687E80
                                          • QSocks5SocketEnginePrivate::_q_controlSocketReadNotification: Unexpectedly received data while in state=%d and mode=%d, xrefs: 6A6864AA
                                          • Proxy authentication failed: %1, xrefs: 6A687FE5
                                          • Socks5 host did not support authentication method., xrefs: 6A687F9A
                                          • Proxy authentication failed, xrefs: 6A687FC1
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteString@@$Array@@$Logger@@Message$?append@?at@?read@?tr@?warning@Array@@@Array@@_Buffer@@Device@@MetaObject@@Ring
                                          • String ID: $Proxy authentication failed$Proxy authentication failed: %1$QSocks5SocketEnginePrivate::_q_controlSocketReadNotification: Unexpectedly received data while in state=%d and mode=%d$SOCKS version 5 protocol error$Socks5 host did not support authentication method.
                                          • API String ID: 750954984-2756636947
                                          • Opcode ID: a42d7a49a7ab47d6237aa0ed5ebac0ca9b41194b0f2d09d12f15ddaa75a46e52
                                          • Instruction ID: 6cd70d0133309ede26e89354190efc8e06d953842b73091a190529667b89af65
                                          • Opcode Fuzzy Hash: a42d7a49a7ab47d6237aa0ed5ebac0ca9b41194b0f2d09d12f15ddaa75a46e52
                                          • Instruction Fuzzy Hash: 18B1DBB5204201DFDB00DF69D858BAABBF8FF85714F414459F656872A1DF30AD09CBA2
                                          Function 6A620BD0 Relevance: 57.9, APIs: 20, Strings: 13, Instructions: 162COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?at@QByteArray@@QBEDH@Z.QT5CORE(00000000,?,?,6A620940,?,?,?,?,?,?,6BB6C190,6BBE0EA0), ref: 6A620BE6
                                          • tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6A620BF0
                                          • ?compare@QByteArray@@QBEHPBDW4CaseSensitivity@Qt@@@Z.QT5CORE(content-type,00000000), ref: 6A620C1C
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(etag), ref: 6A620C8D
                                          • ?qstricmp@@YAHPBD0@Z.QT5CORE(00000000), ref: 6A620C94
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(if-modified-since), ref: 6A620CB4
                                          • ?qstricmp@@YAHPBD0@Z.QT5CORE(00000000), ref: 6A620CC1
                                          • ?compare@QByteArray@@QBEHPBDW4CaseSensitivity@Qt@@@Z.QT5CORE(location,00000000), ref: 6A620D1D
                                          • ?compare@QByteArray@@QBEHPBDW4CaseSensitivity@Qt@@@Z.QT5CORE(set-cookie,00000000), ref: 6A620D53
                                          • ?compare@QByteArray@@QBEHPBDW4CaseSensitivity@Qt@@@Z.QT5CORE(user-agent,00000000), ref: 6A620D89
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?compare@CaseQt@@@Sensitivity@$?data@?qstricmp@@Char@@String@@$?at@tolower
                                          • String ID: content-disposition$content-length$content-type$cookie$etag$if-match$if-modified-since$if-none-match$last-modified$location$server$set-cookie$user-agent
                                          • API String ID: 525276652-1426515162
                                          • Opcode ID: 7ef068b8d8a7cb0a4af7fb2d18b18bd691ec0bf67a1559ee51fe0f9dca8412b5
                                          • Instruction ID: b71d67303849014dac6d226f244a3dce54271a3273c199e4a85098d89d8a713f
                                          • Opcode Fuzzy Hash: 7ef068b8d8a7cb0a4af7fb2d18b18bd691ec0bf67a1559ee51fe0f9dca8412b5
                                          • Instruction Fuzzy Hash: A84195B130421057EF51266EBD2878EB7B99FC1622F03546AF903CB1D0EF64EDC29A95
                                          Function 6A660140 Relevance: 56.2, APIs: 24, Strings: 8, Instructions: 218networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QObject@@QAE@PAV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A66014B
                                            • Part of subcall function 6A625720: ?normalizedType@QMetaObject@@SA?AVQByteArray@@PBD@Z.QT5CORE(?,QNetworkSession::State,?,6A660164,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A625737
                                            • Part of subcall function 6A625720: ?registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAX1PBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z.QT5CORE(?,?), ref: 6A62575D
                                            • Part of subcall function 6A625720: ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000), ref: 6A62576C
                                            • Part of subcall function 6A660AB0: ?normalizedType@QMetaObject@@SA?AVQByteArray@@PBD@Z.QT5CORE(?,QNetworkSession::SessionError,?,6A660169,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A660AC7
                                            • Part of subcall function 6A660AB0: ?registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAX1PBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z.QT5CORE(?,?), ref: 6A660AED
                                            • Part of subcall function 6A660AB0: ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000), ref: 6A660AFC
                                            • Part of subcall function 6A6256C0: ?normalizedType@QMetaObject@@SA?AVQByteArray@@PBD@Z.QT5CORE(?,QNetworkSession::UsagePolicies,?,6A66016E,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A6256D7
                                            • Part of subcall function 6A6256C0: ?registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAX1PBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z.QT5CORE(?,?), ref: 6A6256FD
                                            • Part of subcall function 6A6256C0: ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000), ref: 6A62570C
                                          • ?identifier@QNetworkConfiguration@@QBE?AVQString@@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A660177
                                            • Part of subcall function 6A661CE0: ??0QString@@QAE@XZ.QT5CORE(?,?,6A660E11,?), ref: 6A661CEE
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A660185
                                          • ?qNetworkConfigurationManagerPrivate@@YAPAVQNetworkConfigurationManagerPrivate@@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A660194
                                            • Part of subcall function 6A661510: ?lock@QMutex@@QAEXXZ.QT5CORE ref: 6A66153C
                                            • Part of subcall function 6A661510: ??0QNetworkConfigurationManagerPrivate@@QAE@XZ.QT5NETWORK ref: 6A661562
                                            • Part of subcall function 6A661510: ?currentThread@QThread@@SAPAV1@XZ.QT5CORE ref: 6A661569
                                            • Part of subcall function 6A661510: ?mainThread@QCoreApplicationPrivate@@SAPAVQThread@@XZ.QT5CORE ref: 6A661571
                                            • Part of subcall function 6A661510: ?qAddPreRoutine@@YAXP6AXXZ@Z.QT5CORE(6A661460), ref: 6A661580
                                            • Part of subcall function 6A661510: ?qAddPostRoutine@@YAXP6AXXZ@Z.QT5CORE(6A661440), ref: 6A66158B
                                            • Part of subcall function 6A661510: ?initialize@QNetworkConfigurationManagerPrivate@@QAEXXZ.QT5NETWORK(?,?,?,?,?,?,?,6A612CAB), ref: 6A661596
                                            • Part of subcall function 6A661510: ?unlock@QMutexLocker@@QAEXXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,6A612CAB), ref: 6A661608
                                          • ?engines@QNetworkConfigurationManagerPrivate@@QBE?AV?$QList@PAVQBearerEngine@@@@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A6601AD
                                            • Part of subcall function 6A663D00: ?lock@QMutex@@QAEXXZ.QT5CORE(?,6BAFB7C0,6A6601B2,?,?,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A663D07
                                            • Part of subcall function 6A663D00: ?unlock@QMutex@@QAEXXZ.QT5CORE(0000001C,?,6BAFB7C0,6A6601B2,?,?,?,?,?,?,?,?,?,6A665AF5,?,00000000), ref: 6A663D1D
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A66020F
                                          • ?identifier@QNetworkConfiguration@@QBE?AVQString@@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A660254
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A660266
                                          • ??4QNetworkConfiguration@@QAEAAV0@ABV0@@Z.QT5NETWORK(?,?,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A66029A
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2quitPendingWaitsForOpened(),00000000,2opened(),00000000,?,?,?,?,?,?,?,?,6A665AF5,?), ref: 6A6602C2
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,6A665AF5,?,00000000), ref: 6A6602D1
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2error(QNetworkSession::SessionError),00000000,2error(QNetworkSession::SessionError),00000000), ref: 6A6602E8
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A6602F1
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2stateChanged(QNetworkSession::State),00000000,2stateChanged(QNetworkSession::State),00000000), ref: 6A660308
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A660311
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2closed(),00000000,2closed(),00000000), ref: 6A660328
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A660331
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2preferredConfigurationChanged(QNetworkConfiguration,bool),00000000,2preferredConfigurationChanged(QNetworkConfiguration,bool),00000000), ref: 6A660348
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A660351
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2newConfigurationActivated(),00000000,2newConfigurationActivated(),00000000), ref: 6A660368
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A660371
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2usagePoliciesChanged(QNetworkSession::UsagePolicies),00000000,2usagePoliciesChanged(QNetworkSession::UsagePolicies),00000000), ref: 6A660388
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A660391
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A6603B7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Meta$Object@@$Connection@$Type@$Array@@Byte$Network$?connect@ConnectionQt@@@$Private@@$ConfigurationManagerString@@$?normalized?registerConfiguration@@Flag@Flags@Mutex@@NormalizedObject@@@TypeType@@Type@@@@$?dispose@?identifier@?lock@?unlock@Data@1@@Data@@ListRoutine@@Thread@Thread@@V0@@$?current?engines@?initialize@?mainApplicationBearerCoreEngine@@@@List@Locker@@MutexPost
                                          • String ID: 2closed()$2error(QNetworkSession::SessionError)$2newConfigurationActivated()$2opened()$2preferredConfigurationChanged(QNetworkConfiguration,bool)$2quitPendingWaitsForOpened()$2stateChanged(QNetworkSession::State)$2usagePoliciesChanged(QNetworkSession::UsagePolicies)
                                          • API String ID: 2963468684-3682561693
                                          • Opcode ID: fbd1dfbe94c510bd1e9705d400cc2534a8fa4443289d9b97fa2d2b30641f23e8
                                          • Instruction ID: 7383421817bc85aa2a9949a2a9a9b5aa2e58c0a59b18e6736e43335178546f57
                                          • Opcode Fuzzy Hash: fbd1dfbe94c510bd1e9705d400cc2534a8fa4443289d9b97fa2d2b30641f23e8
                                          • Instruction Fuzzy Hash: 1D71B070504309AFCB00EF69CC84E5A7BB8FF45358F425529F95A972A0EF31E944CB92
                                          Function 6A68CAE0 Relevance: 56.1, APIs: 3, Strings: 29, Instructions: 141timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(6A68DED8,Unknown error,00000000,000000FF,?,6A68DED8,-FFFFD8E3), ref: 6A68CC8C
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(?), ref: 6A68CC9A
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A68CCA4
                                          Strings
                                          • The remote host closed the connection, xrefs: 6A68CB40
                                          • Operation on non-socket, xrefs: 6A68CC46
                                          • Connection reset by peer, xrefs: 6A68CC72
                                          • Attempt to use IPv6 socket on a platform with no IPv6 support, xrefs: 6A68CB32
                                          • The bound address is already in use, xrefs: 6A68CBDA
                                          • Temporary error, xrefs: 6A68CC5C
                                          • Unable to write, xrefs: 6A68CC25
                                          • Unable to send a message, xrefs: 6A68CC0F
                                          • Protocol type not supported, xrefs: 6A68CB78
                                          • Host unreachable, xrefs: 6A68CB94
                                          • Permission denied, xrefs: 6A68CBB0
                                          • Datagram was too large to send, xrefs: 6A68CC04
                                          • Unknown error, xrefs: 6A68CC7D
                                          • Invalid socket descriptor, xrefs: 6A68CB86
                                          • Network operation timed out, xrefs: 6A68CB4E
                                          • The proxy type is invalid for this operation, xrefs: 6A68CC51
                                          • Connection timed out, xrefs: 6A68CBBE
                                          • Connection refused, xrefs: 6A68CBCC
                                          • The address is not available, xrefs: 6A68CBE8
                                          • Unable to initialize broadcast socket, xrefs: 6A68CB24
                                          • Unable to initialize non-blocking socket, xrefs: 6A68CB16
                                          • Unsupported socket operation, xrefs: 6A68CB6A
                                          • Unable to receive a message, xrefs: 6A68CC1A
                                          • The address is protected, xrefs: 6A68CBF6
                                          • Network error, xrefs: 6A68CC30
                                          • Network dropped connection on reset, xrefs: 6A68CC67
                                          • Out of resources, xrefs: 6A68CB5C
                                          • Another socket is already listening on the same port, xrefs: 6A68CC3B
                                          • Network unreachable, xrefs: 6A68CBA2
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$?tr@DateMetaObject@@Time@@V0@$$V0@@
                                          • String ID: Another socket is already listening on the same port$Attempt to use IPv6 socket on a platform with no IPv6 support$Connection refused$Connection reset by peer$Connection timed out$Datagram was too large to send$Host unreachable$Invalid socket descriptor$Network dropped connection on reset$Network error$Network operation timed out$Network unreachable$Operation on non-socket$Out of resources$Permission denied$Protocol type not supported$Temporary error$The address is not available$The address is protected$The bound address is already in use$The proxy type is invalid for this operation$The remote host closed the connection$Unable to initialize broadcast socket$Unable to initialize non-blocking socket$Unable to receive a message$Unable to send a message$Unable to write$Unknown error$Unsupported socket operation
                                          • API String ID: 691198089-3960112156
                                          • Opcode ID: 906625815f99eed4b6555795586aabf1e53767b288a17697a6eef427ea39cfde
                                          • Instruction ID: a0eb0368f0fac1dbb55f8ea38cb585fba10292f4ddea6f542009ff46df49e541
                                          • Opcode Fuzzy Hash: 906625815f99eed4b6555795586aabf1e53767b288a17697a6eef427ea39cfde
                                          • Instruction Fuzzy Hash: 45419AB02CE262B5EF30452C4E4AF823578D703B31EB087167333796E8AE9C7A55456B
                                          Function 6A624A40 Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 285networkCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A61C480: ??0QVariant@@QAE@ABV0@@Z.QT5CORE(?,?,6A65C2CB,?,?), ref: 6A61C4D8
                                          • ?toLongLong@QVariant@@QBE_JPA_N@Z.QT5CORE(00000000,?), ref: 6A624AB3
                                          • ??0QVariant@@QAE@_J@Z.QT5CORE(?,?), ref: 6A624ACB
                                          • ??4QVariant@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000001), ref: 6A624ADA
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A624AE4
                                          • ?state@QNetworkSession@@QBE?AW4State@1@XZ.QT5NETWORK(00000001,?), ref: 6A624B3F
                                          • ?isNull@QVariant@@QBE_NXZ.QT5CORE(00000001,?), ref: 6A624B6B
                                          • ??0QVariant@@QAE@_J@Z.QT5CORE(?,?), ref: 6A624B89
                                          • ?cmp@QVariant@@QBE_NABV1@@Z.QT5CORE(?), ref: 6A624B98
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A624BA4
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A624BD9
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Temporary network failure.,00000000,000000FF), ref: 6A624BF6
                                            • Part of subcall function 6A6249B0: ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6249CA
                                            • Part of subcall function 6A6249B0: ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNetworkReplyImplPrivate::error: Internal problem, this method must only be called once.), ref: 6A6249D6
                                          • ??1QString@@QAE@XZ.QT5CORE(00000007,?), ref: 6A624C0E
                                            • Part of subcall function 6A625880: ??0QEvent@@QAE@W4Type@0@@Z.QT5CORE(000000B9,?), ref: 6A6258B3
                                            • Part of subcall function 6A625880: ?postEvent@QCoreApplication@@SAXPAVQObject@@PAVQEvent@@H@Z.QT5CORE(?,00000000,00000000), ref: 6A6258C3
                                          • ?setFinished@QNetworkReply@@IAEX_N@Z.QT5NETWORK(00000001,?), ref: 6A624C36
                                          • ?isNull@QVariant@@QBE_NXZ.QT5CORE(00000001,?), ref: 6A624C52
                                          • ??0QVariant@@QAE@H@Z.QT5CORE(000000FF), ref: 6A624C62
                                          • ?cmp@QVariant@@QBE_NABV1@@Z.QT5CORE(?), ref: 6A624C76
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A624C96
                                          • ?toLongLong@QVariant@@QBE_JPA_N@Z.QT5CORE(00000000), ref: 6A624CB9
                                          • ?downloadProgress@QNetworkReply@@QAEX_J0@Z.QT5NETWORK(?,?,?,?), ref: 6A624CE0
                                          • ?uploadProgress@QNetworkReply@@QAEX_J0@Z.QT5NETWORK(00000000,00000000,00000000,00000000,?,?,?,?), ref: 6A624D12
                                          • ?isNull@QVariant@@QBE_NXZ.QT5CORE(?,?,?,?), ref: 6A624D22
                                          • ??0QVariant@@QAE@H@Z.QT5CORE(000000FF), ref: 6A624D32
                                          • ?cmp@QVariant@@QBE_NABV1@@Z.QT5CORE(?), ref: 6A624D44
                                          • ??0QVariant@@QAE@_J@Z.QT5CORE(?,?), ref: 6A624D5E
                                          • ?cmp@QVariant@@QBE_NABV1@@Z.QT5CORE(?), ref: 6A624D70
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A624D90
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A624D9B
                                          • ?readChannelFinished@QIODevice@@QAEXXZ.QT5CORE ref: 6A624E28
                                          • ?finished@QNetworkReply@@QAEXXZ.QT5NETWORK ref: 6A624E30
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A624E40
                                          Strings
                                          • Temporary network failure., xrefs: 6A624BE7
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Variant@@$Network$?cmp@Reply@@V1@@$Null@$Event@@Finished@Logger@@LongLong@MessageObject@@Progress@String@@V0@@$?download?finished@?post?read?set?state@?tr@?upload?warning@Application@@ChannelCoreDevice@@Event@MetaSession@@State@1@Type@0@@V0@$$
                                          • String ID: Temporary network failure.
                                          • API String ID: 784569229-3722165266
                                          • Opcode ID: cf2e2996f303a1cf28a55e55846e16a001564e9b30cc0e44e30c38f3a02c8cc5
                                          • Instruction ID: 3c76bc95ee026115ec166f8081e26fc45a362fcecf6c3216879a6cf61e1f4411
                                          • Opcode Fuzzy Hash: cf2e2996f303a1cf28a55e55846e16a001564e9b30cc0e44e30c38f3a02c8cc5
                                          • Instruction Fuzzy Hash: 34B14D702087058FEB15DF68C898BEBB7E4AF85304F41491DE5AB87291DFB0A949CF52
                                          Function 6A634030 Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 282networkwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isValid@QNetworkCacheMetaData@@QBE_NXZ.QT5NETWORK ref: 6A634050
                                          • ?url@QNetworkCacheMetaData@@QBE?AVQUrl@@XZ.QT5NETWORK(?), ref: 6A634065
                                            • Part of subcall function 6A6286A0: ??0QUrl@@QAE@ABV0@@Z.QT5CORE ref: 6A6286AA
                                          • ?isValid@QUrl@@QBE_NXZ.QT5CORE ref: 6A63406C
                                          • ?saveToDisk@QNetworkCacheMetaData@@QBE_NXZ.QT5NETWORK ref: 6A634078
                                          • ??1QUrl@@QAE@XZ.QT5CORE ref: 6A634094
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A6340B4
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNetworkDiskCache::prepare() The cache directory is not set), ref: 6A6340C0
                                          • ?rawHeaders@QNetworkCacheMetaData@@QBE?AV?$QList@U?$QPair@VQByteArray@@V1@@@@@XZ.QT5NETWORK(?), ref: 6A6340DC
                                          • ?compare@QByteArray@@QBEHPBDW4CaseSensitivity@Qt@@@Z.QT5CORE(content-length,00000000,?), ref: 6A63410B
                                          • ?toLongLong@QByteArray@@QBE_JPA_NH@Z.QT5CORE(00000000,0000000A), ref: 6A634125
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6A634152
                                          • ??0QNetworkCacheMetaData@@QAE@XZ.QT5NETWORK ref: 6A634179
                                          • ??0QBuffer@@QAE@PAVQObject@@@Z.QT5CORE(00000000), ref: 6A634185
                                          • ??4QNetworkCacheMetaData@@QAEAAV0@ABV0@@Z.QT5NETWORK(?), ref: 6A634195
                                          • ??0QTemporaryFile@@QAE@ABVQString@@PAVQObject@@@Z.QT5CORE(?,00000004,?), ref: 6A6341E1
                                          • ?open@QTemporaryFile@@QAE_NXZ.QT5CORE ref: 6A6341F2
                                          • ??1QString@@QAE@XZ.QT5CORE(?), ref: 6A634211
                                          • ?rehash@QHashData@@QAEXH@Z.QT5CORE(?,?,?), ref: 6A634258
                                          • ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000004,?,?), ref: 6A634279
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A6342BA
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNetworkDiskCache::prepare() unable to open temporary file), ref: 6A6342C6
                                          • ??0QNetworkCacheMetaData@@QAE@XZ.QT5NETWORK ref: 6A6342D3
                                            • Part of subcall function 6A6278D0: ??0QMutex@@QAE@XZ.QT5CORE(6A657FD2,?,?,?,?,?,?,?,?,?,?,?,?,?,6A65B483), ref: 6A6278E2
                                            • Part of subcall function 6A6278D0: ??0QMutex@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,6A65B483), ref: 6A6278EB
                                            • Part of subcall function 6A6278D0: ??0QDateTime@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,6A65B483), ref: 6A6278F4
                                            • Part of subcall function 6A6278D0: ??0QDateTime@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,6A65B483), ref: 6A6278FD
                                          • ??1QNetworkCacheMetaData@@QAE@XZ.QT5NETWORK ref: 6A6342E4
                                          • ??1QBuffer@@UAE@XZ.QT5CORE ref: 6A634307
                                          • ??1QNetworkCacheMetaData@@QAE@XZ.QT5NETWORK ref: 6A63430F
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A634323
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,-00000004), ref: 6A63436E
                                          Strings
                                          • QNetworkDiskCache::prepare() The cache directory is not set, xrefs: 6A6340BA
                                          • QNetworkDiskCache::prepare() unable to open temporary file, xrefs: 6A6342C0
                                          • content-length, xrefs: 6A634106
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@$CacheMetaNetwork$Logger@@MessageUrl@@$Array@@ByteString@@$?warning@Buffer@@DateFile@@HashMutex@@Object@@@TemporaryTime@@V0@@Valid@$?allocate?compare@?dispose@?open@?raw?rehash@?save?url@CaseData@1@@Disk@Headers@ListList@LongLong@Node@Pair@Qt@@@Sensitivity@Unothrow_t@std@@@V1@@@@@__ehfuncinfo$??2@
                                          • String ID: QNetworkDiskCache::prepare() The cache directory is not set$QNetworkDiskCache::prepare() unable to open temporary file$content-length
                                          • API String ID: 1781679336-3823428906
                                          • Opcode ID: 1c3b46710dc3447ae0d494ba76989c7015fa39e1a8b639b5cac546ec8f8b8c57
                                          • Instruction ID: 438c42c66aee4d955e4b9b8e7b8ff84c5f3db6736de811b2663df0d121759568
                                          • Opcode Fuzzy Hash: 1c3b46710dc3447ae0d494ba76989c7015fa39e1a8b639b5cac546ec8f8b8c57
                                          • Instruction Fuzzy Hash: 34A19CB06043109FDB04DF65C888B6AFBE5EF89315F42446CE9569B391DF71E80ACB92
                                          Function 6A688080 Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 242COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,6A6863C8), ref: 6A688093
                                          • ?prepend@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(?,?,?,?,?,?,?,?,6A6863C8), ref: 6A6880C0
                                          • ?clear@QByteArray@@QAEXXZ.QT5CORE(?,?,?,?,?,?,?,6A6863C8), ref: 6A6880C8
                                          • ??4QByteArray@@QAEAAV0@ABV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,6A6863C8), ref: 6A6880DF
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,6A6863C8), ref: 6A6880E9
                                          • ??0QHostAddress@@QAE@XZ.QT5NETWORK(?,?,?,?,?,?,?,6A6863C8), ref: 6A6880FA
                                          • ?at@QByteArray@@QBEDH@Z.QT5CORE ref: 6A68810D
                                          • ?at@QByteArray@@QBEDH@Z.QT5CORE(00000002), ref: 6A688121
                                          • ?at@QByteArray@@QBEDH@Z.QT5CORE(00000001), ref: 6A688135
                                          • ?at@QByteArray@@QBEDH@Z.QT5CORE(00000001), ref: 6A688149
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A68816C
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(00000000,Host not found,00000000,000000FF), ref: 6A688188
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6881A0
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,6A6863C8), ref: 6A6882F9
                                          • ??4QHostAddress@@QAEAAV0@ABV0@@Z.QT5NETWORK(00000000), ref: 6A68830F
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK ref: 6A6883A2
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,6A6863C8), ref: 6A6883AB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$String@@$?at@$Address@@Host$V0@@$?clear@?prepend@?tr@MetaObject@@V1@@
                                          • String ID: Host not found$SOCKS version 5 protocol error
                                          • API String ID: 2201055735-411601864
                                          • Opcode ID: 3df5584c963594ed2d7280949a7b6cded43d0c3e2f0e431584678c253f541646
                                          • Instruction ID: 249c9dad5accbabf5b125ab5dc02aa0017fea06c3a4d4c374bd83b2bb751b84c
                                          • Opcode Fuzzy Hash: 3df5584c963594ed2d7280949a7b6cded43d0c3e2f0e431584678c253f541646
                                          • Instruction Fuzzy Hash: BF914CB0204702AFDB14DF55C898BAABBF9FF95354F014819E556C32A1DF30E909CBA2
                                          Function 6A61C170 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 249networkCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A61AF50: ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A6258F7
                                            • Part of subcall function 6A61AF50: ?className@QMetaObject@@QBEPBDXZ.QT5CORE ref: 6A62590B
                                            • Part of subcall function 6A61AF50: ?debug@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNetworkReplyImpl: setCachingEnabled(true) called after setCachingEnabled(false) -- backend %s probably needs to be fixed,00000000), ref: 6A625918
                                          • ??1QUrl@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A61C089), ref: 6A61C1B7
                                          • ?isValid@QNetworkCacheMetaData@@QBE_NXZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A61C089), ref: 6A61C1C1
                                          • ??1QNetworkCacheMetaData@@QAE@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A61C089), ref: 6A61C1D0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Meta$CacheData@@Logger@@MessageNetwork$?class?debug@Name@Object@@Url@@Valid@
                                          • String ID: cache-control$must-revalidate$no-cache
                                          • API String ID: 2356513377-1948583773
                                          • Opcode ID: 349eb040685c153cf6d3b479fa92636915f37db582155286865df5612af54dee
                                          • Instruction ID: 2fc269df844935b909428ea04a2a375c82f634188c987017fe9a338d7f9dbbc4
                                          • Opcode Fuzzy Hash: 349eb040685c153cf6d3b479fa92636915f37db582155286865df5612af54dee
                                          • Instruction Fuzzy Hash: 64914F712083059FCB00DF68C894AAE7BE8AF95218F41092DE857D7291DF34FD09CB95
                                          Function 6A620220 Relevance: 47.4, APIs: 25, Strings: 2, Instructions: 180timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?indexOf@QByteArray@@QBEHDH@Z.QT5CORE(0000002C,00000000,?,?,00000001), ref: 6A620230
                                          • ??0QDateTime@@QAE@XZ.QT5CORE(?,?,00000001), ref: 6A62023E
                                          • ?fromLatin1@QString@@SA?AV1@ABVQByteArray@@@Z.QT5CORE(?,?,00000000,?,?,00000001), ref: 6A620251
                                          • ?fromString@QDateTime@@SA?AV1@ABVQString@@W4DateFormat@Qt@@@Z.QT5CORE(?,00000000,?,00000001), ref: 6A620260
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A62026C
                                          • ??1QDateTime@@QAE@XZ.QT5CORE ref: 6A620276
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A620280
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(%*3s, %d %3s %d %d:%d:%d 'GMT',?,?,00000004,?,?,?,?,?,?,00000001), ref: 6A6202BB
                                          • ??0QTime@@QAE@HHHH@Z.QT5CORE(?,?,?,00000000), ref: 6A6202E5
                                          • ?isValid@QDateTime@@QBE_NXZ.QT5CORE(?,00000000), ref: 6A620455
                                          • ?setTimeSpec@QDateTime@@QAEXW4TimeSpec@Qt@@@Z.QT5CORE(00000001), ref: 6A620463
                                          Strings
                                          • %*3s, %d %3s %d %d:%d:%d 'GMT', xrefs: 6A6202B6
                                          • dd-MMM-yy hh:mm:ss 'GMT', xrefs: 6A6203FC
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DateTime@@$String@@$?fromByteQt@@@Spec@Time$?data@?index?setArray@@Array@@@Char@@Format@Latin1@String@V0@$$V0@@Valid@
                                          • String ID: %*3s, %d %3s %d %d:%d:%d 'GMT'$dd-MMM-yy hh:mm:ss 'GMT'
                                          • API String ID: 3867017391-74561969
                                          • Opcode ID: fc7728586f66fc029c3ebb1fad8b789e9faecddd9a4c41ac7b2a65de712a10c0
                                          • Instruction ID: f337ed502a6ea26cb1a356c104fa9d95c59e1cb07d60cdecb10ca68e01c50695
                                          • Opcode Fuzzy Hash: fc7728586f66fc029c3ebb1fad8b789e9faecddd9a4c41ac7b2a65de712a10c0
                                          • Instruction Fuzzy Hash: F25194B1508206EBEB509B55C868B9F77F9EB86305F02452AF197C21D0DE64AE48CF52
                                          Function 6A65CAB0 Relevance: 43.9, APIs: 16, Strings: 9, Instructions: 146networkwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2error(QNetworkSession::SessionError),?,1_q_networkSessionFailed(),00000002,?,?), ref: 6A65CAE9
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A65CAF6
                                          • ?isOpen@QNetworkSession@@QBE_NXZ.QT5NETWORK ref: 6A65CAFE
                                          • ??0QVariant@@QAE@HPBXI@Z.QT5CORE(00000001,?,00000000), ref: 6A65CB18
                                          • ?attribute@QNetworkRequest@@QBE?AVQVariant@@W4Attribute@1@ABV2@@Z.QT5NETWORK(?,00000011,?), ref: 6A65CB30
                                            • Part of subcall function 6A61FF90: ??0QVariant@@QAE@ABV0@@Z.QT5CORE(?,?,00000000,?,6A6266BD,?,00000011,00000000), ref: 6A61FFC5
                                          • ??1QVariant@@QAE@XZ.QT5CORE(?,00000011,?), ref: 6A65CB3F
                                          • ?setSessionProperty@QNetworkSession@@QAEXABVQString@@ABVQVariant@@@Z.QT5NETWORK(?), ref: 6A65CB55
                                            • Part of subcall function 6A660ED0: ??8QString@@QBE_NVQLatin1String@@@Z.QT5CORE(00000013,ActiveConfiguration,?,6BC95110,6A65CB5A,?), ref: 6A660EE7
                                            • Part of subcall function 6A660ED0: ??8QString@@QBE_NVQLatin1String@@@Z.QT5CORE(00000017,UserChoiceConfiguration), ref: 6A660EFA
                                          • ??1QString@@QAE@XZ.QT5CORE(?), ref: 6A65CB5E
                                          • ?open@QNetworkSession@@QAEXXZ.QT5NETWORK ref: 6A65CB66
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A65CB6F
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000,?,?), ref: 6A65CB95
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,Backend is waiting for QNetworkSession to connect, but there is none!), ref: 6A65CBA1
                                          • ?translate@QCoreApplication@@SA?AVQString@@PBD00H@Z.QT5CORE(?,QNetworkReply,Network session error.,00000000,000000FF), ref: 6A65CBBA
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE ref: 6A65CC19
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A65CC25
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(?,_q_finished,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6A65CC64
                                          Strings
                                          • Backend is waiting for QNetworkSession to connect, but there is none!, xrefs: 6A65CB9B
                                          • _q_error, xrefs: 6A65CC02
                                          • _q_finished, xrefs: 6A65CC58
                                          • QNetworkReply, xrefs: 6A65CBB4
                                          • QString, xrefs: 6A65CBF1
                                          • QNetworkReply::NetworkError, xrefs: 6A65CBF7
                                          • Network session error., xrefs: 6A65CBAB
                                          • 1_q_networkSessionFailed(), xrefs: 6A65CAD8
                                          • 2error(QNetworkSession::SessionError), xrefs: 6A65CADE
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$String@@$Variant@@$GenericMetaNetwork$ConnectionSession@@Type@$?invokeArgument@@Argument@@444444444@Connection@Latin1Logger@@MessageMethod@Qt@@ReturnString@@@$?attribute@?connect@?open@?set?translate@?warning@Application@@Attribute@1@CoreOpen@Property@Qt@@@Request@@SessionV0@@V2@@Variant@@@
                                          • String ID: 1_q_networkSessionFailed()$2error(QNetworkSession::SessionError)$Backend is waiting for QNetworkSession to connect, but there is none!$Network session error.$QNetworkReply$QNetworkReply::NetworkError$QString$_q_error$_q_finished
                                          • API String ID: 4218168388-3126378000
                                          • Opcode ID: 1dca8e347c2e59187be1a373b5fcba0075bc87d93d157c32ca667f02a1d5e39e
                                          • Instruction ID: 4ee0b3afe6ae1b418967e5785f0f3fa2e4dabb882b7c333aee9d4cb107103749
                                          • Opcode Fuzzy Hash: 1dca8e347c2e59187be1a373b5fcba0075bc87d93d157c32ca667f02a1d5e39e
                                          • Instruction Fuzzy Hash: A5414A75144341AFEB10DB60CC55FABB7F8EF95704F114819F696A6190EF70B908CB52
                                          Function 6A63C810 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 140COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A63C824
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(Connection,000000FF), ref: 6A63C83D
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A63C852
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A63C85C
                                          • ?append@QByteArray@@QAEAAV1@PBD@Z.QT5CORE(6A6C26C8), ref: 6A63C87B
                                          • ?append@QByteArray@@QAEAAV1@PBD@Z.QT5CORE(Upgrade, HTTP2-Settings), ref: 6A63C886
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(Connection,000000FF), ref: 6A63C898
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A63C8AC
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(h2c,000000FF), ref: 6A63C8C2
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(Upgrade,000000FF), ref: 6A63C8CF
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A63C8E3
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A63C8ED
                                          • ?fromRawData@QByteArray@@SA?AV1@PBDH@Z.QT5CORE(?,00000000,00000000), ref: 6A63C924
                                          • ?toBase64@QByteArray@@QBE?AV1@V?$QFlags@W4Base64Option@QByteArray@@@@@Z.QT5CORE(?,00000003), ref: 6A63C938
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A63C942
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(HTTP2-Settings,000000FF), ref: 6A63C953
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A63C967
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A63C971
                                          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6A63C9A3
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A63C9CF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$Array@@$?append@$?fromArray@@@@@Base64Base64@Data@Flags@Option@String@@_invalid_parameter_noinfo_noreturn
                                          • String ID: Connection$HTTP2-Settings$Upgrade$Upgrade, HTTP2-Settings$h2c
                                          • API String ID: 2160051847-2401737358
                                          • Opcode ID: fb138751d4ad4f3ea8bd4cdcb21dc06f8355443217a806955e0ee56cc5b84011
                                          • Instruction ID: 4de12b32c68e09d10450ec03a8c2b83a73777f1650a751baa5b95a153a12c6c8
                                          • Opcode Fuzzy Hash: fb138751d4ad4f3ea8bd4cdcb21dc06f8355443217a806955e0ee56cc5b84011
                                          • Instruction Fuzzy Hash: B6512DB24082169BCB04DF65DD9899E7BF8FF99214F014A19F55393291EF30ED09CB92
                                          Function 6A680020 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 237networktimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,?,?,6BC7FE10,?,?), ref: 6A680059
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK(?,?,?,?,6BC7FE10,?,?), ref: 6A6800B3
                                          • ?erase@QListData@@QAEPAPAXPAPAX@Z.QT5CORE(?,?,?,?,?,6BC7FE10,?,?), ref: 6A6800C6
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,?,6A6814CC), ref: 6A6800E6
                                          • ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK ref: 6A6800F6
                                          • ??0QTimer@@QAE@PAVQObject@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A6814CC), ref: 6A680174
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,00000000,2timeout(),?,1_q_abortConnectionAttempt(),00000001), ref: 6A680199
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A6801A6
                                          • ?property@QObject@@QBE?AVQVariant@@PBD@Z.QT5CORE(?,_q_networksession), ref: 6A6801C3
                                          • ??1QVariant@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A6814CC), ref: 6A6801DB
                                          • ?configuration@QNetworkSession@@QBE?AVQNetworkConfiguration@@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A6814CC), ref: 6A6801EE
                                          • ?connectTimeout@QNetworkConfiguration@@QBEHXZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A6814CC), ref: 6A6801F7
                                          • ??1QNetworkConfiguration@@QAE@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A6814CC), ref: 6A680202
                                          • ?start@QTimer@@QAEXH@Z.QT5CORE(00007530,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A6814CC), ref: 6A68020E
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Connection refused,00000000,000000FF), ref: 6A680284
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(00000000,?), ref: 6A6802C2
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6802CC
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(?,?,00000003,?), ref: 6A680303
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(?,?,00000005,?), ref: 6A68032C
                                            • Part of subcall function 6A680740: ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(?,6BC7FE10,?,?,6A680051,?,?,6BC7FE10,?,?), ref: 6A680762
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$MetaNetwork$Address@@Configuration@@HostString@@$?activate@Connection@Data@@ListTimer@@V0@@Variant@@$?configuration@?connect?connect@?detach@?erase@?property@?protocol@?start@?tr@AbstractAuthenticator@@ConnectionData@1@LayerObject@@@Protocol@Qt@@@Session@@SharedSocket@@Timeout@Type@
                                          • String ID: 1_q_abortConnectionAttempt()$2timeout()$Connection refused$_q_networksession
                                          • API String ID: 855251977-1692703324
                                          • Opcode ID: fbd75c4d4a00d119f72967247dba1e289d13d50c52ed4f2709183c7e96a0f214
                                          • Instruction ID: f37b828259306db58140af5b930b72440acd9e522b0cd41c78dc1448fa399585
                                          • Opcode Fuzzy Hash: fbd75c4d4a00d119f72967247dba1e289d13d50c52ed4f2709183c7e96a0f214
                                          • Instruction Fuzzy Hash: AF9172B1605205AFD704CF64C894F9AB7F8FF45319F020A29F95A93251DF34E919CBA2
                                          Function 6A6B62E0 Relevance: 40.5, APIs: 16, Strings: 7, Instructions: 211COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Invalid protocol version, DTLS protocol expected,00000000,000000FF,?,?,?,?,?,?), ref: 6A6B6309
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A6B631B
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6B6325
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                            • Part of subcall function 6A6951C0: ??0QSharedData@@QAE@ABV0@@Z.QT5CORE(00000000,00000000,00000000,6A69CC8E,?,00000000,?,?,?,?,6A6B23C1,?), ref: 6A6951C9
                                            • Part of subcall function 6A6951C0: ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(00000004,?,?,?,?,6A6B23C1,?), ref: 6A6951D6
                                            • Part of subcall function 6A6951C0: ??0QSslKey@@QAE@ABV0@@Z.QT5NETWORK(00000010,0000000C,00000008,00000004,?,?,?,?,6A6B23C1,?), ref: 6A6951FA
                                            • Part of subcall function 6A6951C0: ??0QSslCipher@@QAE@ABV0@@Z.QT5NETWORK(00000014,00000010,0000000C,00000008,00000004,?,?,?,?,6A6B23C1,?), ref: 6A695206
                                            • Part of subcall function 6A6951C0: ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(0000003C,00000038,00000020,0000001C,00000014,00000010,0000000C,00000008,00000004,?,?,?,?,6A6B23C1,?), ref: 6A695262
                                            • Part of subcall function 6A6951C0: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000044,?,?,?,?,6A6B23C1,?), ref: 6A6952BF
                                            • Part of subcall function 6A6951C0: ??0QSslKey@@QAE@ABV0@@Z.QT5NETWORK(0000004C,?,?,?,?,6A6B23C1,?), ref: 6A6952D2
                                            • Part of subcall function 6A6951C0: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000050,0000004C,?,?,?,?,6A6B23C1,?), ref: 6A6952DE
                                            • Part of subcall function 6A6951C0: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000058,00000054,?,?,?,?,6A6B23C1,?), ref: 6A6952F7
                                            • Part of subcall function 6A6B50A0: ?writeNotification@QTcpServerPrivate@@UAEXXZ.QT5NETWORK(00000001,?,00000001,?), ref: 6A6B50F1
                                            • Part of subcall function 6A6B50A0: ?writeNotification@QTcpServerPrivate@@UAEXXZ.QT5NETWORK(?,?,00000001,?,00000001,?), ref: 6A6B50F9
                                          • ??1QSslConfiguration@@QAE@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?), ref: 6A6B6395
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(00000000,?,?,?,?,?,?,?), ref: 6A6B63BD
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?), ref: 6A6B63C7
                                          • ?writeNotification@QTcpServerPrivate@@UAEXXZ.QT5NETWORK(00000000,00000000,00000001,00000014,?,?,?,?,?,?,?,?,?,?,?), ref: 6A6B6420
                                          • ?writeNotification@QTcpServerPrivate@@UAEXXZ.QT5NETWORK(?,00000000,00000000,00000000,00000001,00000014,?,?,?,?,?,?), ref: 6A6B642B
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,%1 failed,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A6B6449
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(00000020), ref: 6A6B645B
                                          • ?arg@QString@@QBE?AV1@VQLatin1String@@HVQChar@@@Z.QT5CORE(?,0000000F,SSL_set_ex_data,00000000), ref: 6A6B64CA
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6B64D4
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(00000020), ref: 6A6B64E6
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6B64F0
                                            • Part of subcall function 6A6B41A0: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,6A6B0567,?), ref: 6A6B41A8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: V0@@$String@@$?writeArray@@ByteNotification@Private@@Server$?tr@Char@@@Key@@Latin1MetaObject@@Shared$?arg@Authenticator@@Certificate@@Char@@Cipher@@Configuration@@Data@@malloc
                                          • String ID: $ $%1 failed$Invalid SslMode, SslServerMode or SslClientMode expected$Invalid protocol version, DTLS protocol expected$SSL_new$SSL_set_ex_data
                                          • API String ID: 3398099068-4040365616
                                          • Opcode ID: edf73a00c9b7db01d1945b43cc7cee692307258b92a86be448b443baff92caf3
                                          • Instruction ID: 351241ea8128a14e98518aab9eaedbb4bdac9c24e75514cfce01ec4815a68781
                                          • Opcode Fuzzy Hash: edf73a00c9b7db01d1945b43cc7cee692307258b92a86be448b443baff92caf3
                                          • Instruction Fuzzy Hash: 9281BCB1408341AFC710DF24D848B9BBBF4AF85318F014A1DF59A972A2DF70E958CB96
                                          Function 6A650BC0 Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 191timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?reserve@QByteArray@@QAEXH@Z.QT5CORE(00000020), ref: 6A650BDC
                                          • ?read@QIODevice@@QAE_JPAD_J@Z.QT5CORE(?,00000001,00000000), ref: 6A650C0D
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(?), ref: 6A650C65
                                          • ?startsWith@QByteArray@@QBE_NPBD@Z.QT5CORE(HTTP/), ref: 6A650C7A
                                          • ?endsWith@QByteArray@@QBE_ND@Z.QT5CORE(0000000D), ref: 6A650CA9
                                          • ?truncate@QByteArray@@QAEXH@Z.QT5CORE(?), ref: 6A650CBC
                                          • ?startsWith@QByteArray@@QBE_NPBD@Z.QT5CORE(HTTP/), ref: 6A650CD5
                                          • ?at@QByteArray@@QBEDH@Z.QT5CORE(00000006), ref: 6A650CE7
                                          • ?at@QByteArray@@QBEDH@Z.QT5CORE(00000008), ref: 6A650CF9
                                          • ?at@QByteArray@@QBEDH@Z.QT5CORE(00000005), ref: 6A650D0B
                                          • ?at@QByteArray@@QBEDH@Z.QT5CORE(00000007), ref: 6A650D22
                                          • ?indexOf@QByteArray@@QBEHDH@Z.QT5CORE(00000020,00000009), ref: 6A650D37
                                          • ?mid@QByteArray@@QBE?AV1@HH@Z.QT5CORE(?,00000009,-00000009), ref: 6A650D4C
                                          • ?toInt@QByteArray@@QBEHPA_NH@Z.QT5CORE(?,0000000A), ref: 6A650D5D
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(000000FF), ref: 6A650D6A
                                          • ?fromLatin1@QString@@SA?AV1@PBDH@Z.QT5CORE(?,00000001), ref: 6A650D79
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A650D86
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A650D90
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A650DB3
                                          • ?clear@QByteArray@@QAEXXZ.QT5CORE ref: 6A650DC6
                                          • ?clear@QByteArray@@QAEXXZ.QT5CORE ref: 6A650DF0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?at@$String@@With@$?clear@?starts$?append@?data@?ends?from?index?mid@?read@?reserve@?truncate@Char@@DateDevice@@Int@Latin1@Time@@V0@$$V0@@
                                          • String ID: HTTP/$HTTP/
                                          • API String ID: 2424810363-1049685889
                                          • Opcode ID: 40afc54ad686885b6615c88bbac799ead5be84b685f0956d2245530132ef3912
                                          • Instruction ID: a2f22b1cfb90e14466f1c690edee90a8058672c0cd048b5af2cbc2df66330962
                                          • Opcode Fuzzy Hash: 40afc54ad686885b6615c88bbac799ead5be84b685f0956d2245530132ef3912
                                          • Instruction Fuzzy Hash: 6961EEB53083008FDB00DFA9C858B6E77F5BB86319F024619F596CB291EB34E959CB42
                                          Function 6A614030 Relevance: 39.2, APIs: 26, Instructions: 250networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isSequential@QNetworkReply@@UBE_NXZ.QT5NETWORK(0000000C,?), ref: 6A614041
                                          • ?identifier@QNetworkConfiguration@@QBE?AVQString@@XZ.QT5NETWORK(?,?,?,0000000C,?), ref: 6A614059
                                            • Part of subcall function 6A661CE0: ??0QString@@QAE@XZ.QT5CORE(?,?,6A660E11,?), ref: 6A661CEE
                                          • ?state@QNetworkConfiguration@@QBE?AV?$QFlags@W4StateFlag@QNetworkConfiguration@@@@XZ.QT5NETWORK(?,?,?,?,0000000C,?), ref: 6A614067
                                          • ?qHash@@YAIABVQString@@I@Z.QT5CORE(?,?,?,?,?,?,0000000C,?), ref: 6A61408E
                                          • ?defaultConfiguration@QNetworkConfigurationManager@@QBE?AVQNetworkConfiguration@@XZ.QT5NETWORK(?,?,?,00000000,?,?,?,?,0000000C,?), ref: 6A6140D1
                                          • ?identifier@QNetworkConfiguration@@QBE?AVQString@@XZ.QT5NETWORK(?,?,?,?,00000000,?,?,?,?,0000000C,?), ref: 6A6140DD
                                          • ?configuration@QNetworkSession@@QBE?AVQNetworkConfiguration@@XZ.QT5NETWORK(00000000,?,?,?,?,00000000,?,?,?,?,0000000C,?), ref: 6A6140ED
                                          • ?identifier@QNetworkConfiguration@@QBE?AVQString@@XZ.QT5NETWORK(?,00000000,?,?,?,?,00000000,?,?,?,?,0000000C,?), ref: 6A6140F9
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A614127
                                          • ??1QNetworkConfiguration@@QAE@XZ.QT5NETWORK ref: 6A614139
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61414A
                                          • ??1QNetworkConfiguration@@QAE@XZ.QT5NETWORK ref: 6A614159
                                          • ?qHash@@YAIABVQString@@I@Z.QT5CORE(?,?), ref: 6A61417A
                                          • ?rehash@QHashData@@QAEXH@Z.QT5CORE(?,?,00000000,0000000C,?), ref: 6A6141AC
                                          • ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000004,?,00000000,0000000C,?), ref: 6A6141C5
                                          • ?defaultConfiguration@QNetworkConfigurationManager@@QBE?AVQNetworkConfiguration@@XZ.QT5NETWORK(?,?,00000000,0000000C,?), ref: 6A6141FC
                                            • Part of subcall function 6A661470: ?qNetworkConfigurationManagerPrivate@@YAPAVQNetworkConfigurationManagerPrivate@@XZ.QT5NETWORK(?,6A612F2F,00000064,?,?,?,?,?,?,00000000), ref: 6A661471
                                            • Part of subcall function 6A661470: ?defaultConfiguration@QNetworkConfigurationManagerPrivate@@QBE?AVQNetworkConfiguration@@XZ.QT5NETWORK(?,?,6A612F2F,00000064,?,?,?,?,?,?,00000000), ref: 6A661481
                                            • Part of subcall function 6A615D30: ?isValid@QNetworkConfiguration@@QBE_NXZ.QT5NETWORK ref: 6A615DE7
                                          • ??1QNetworkConfiguration@@QAE@XZ.QT5NETWORK(00000000,?,?,00000000,0000000C,?), ref: 6A61420D
                                            • Part of subcall function 6A661870: ??1QString@@QAE@XZ.QT5CORE(?,6A663BB2,?,?,?,00000064,00000000), ref: 6A661889
                                            • Part of subcall function 6A661870: ??1QString@@QAE@XZ.QT5CORE(?,?,00000064,00000000), ref: 6A661892
                                            • Part of subcall function 6A661870: ??1QRecursiveMutex@@QAE@XZ.QT5CORE(?,?,00000064,00000000), ref: 6A66189B
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,00000000,?,?,?,?,0000000C,?), ref: 6A61421F
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A6141E0
                                            • Part of subcall function 6A614330: ?configuration@QNetworkSession@@QBE?AVQNetworkConfiguration@@XZ.QT5NETWORK(?,?,?,6BB1E2C0,?,00000000,?,?,0000000C,?), ref: 6A614386
                                            • Part of subcall function 6A614330: ??1QNetworkConfiguration@@QAE@XZ.QT5NETWORK(?,?,?,6BB1E2C0,?,00000000,?,?,0000000C,?), ref: 6A614399
                                            • Part of subcall function 6A614330: ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(?,2opened(),?,2networkSessionConnected(),?,?,?,6BB1E2C0,?,00000000,?,?,0000000C,?), ref: 6A6143B3
                                            • Part of subcall function 6A614330: ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(?,2closed(),?,1_q_networkSessionClosed(),?,00000000,?,?,0000000C,?), ref: 6A6143C7
                                            • Part of subcall function 6A614330: ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(?,2stateChanged(QNetworkSession::State),?,1_q_networkSessionStateChanged(QNetworkSession::State),?,00000000,?,?,0000000C,?), ref: 6A6143DB
                                            • Part of subcall function 6A614330: ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(?,2error(QNetworkSession::SessionError),?,1_q_networkSessionFailed(QNetworkSession::SessionError),?,00000000,?,?,0000000C,?), ref: 6A6143EF
                                          • ?qHash@@YAIABVQString@@I@Z.QT5CORE(?,?,?,?,?,?,0000000C,?), ref: 6A614244
                                          • ?qHash@@YAIABVQString@@I@Z.QT5CORE(?,?,?,00000000,?,?,?,?,0000000C,?), ref: 6A614281
                                          • ??8@YA_NABVQString@@0@Z.QT5CORE(00000008,-00000008,?,00000000,?,00000000,?,?,?,?,0000000C,?), ref: 6A6142B1
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000000,?,00000000,?,?,?,?,0000000C,?), ref: 6A6142CE
                                          • ?freeNode@QHashData@@QAEXPAX@Z.QT5CORE(6BB1E2C0,?,?,0000000C,?), ref: 6A6142D7
                                          • ?hasShrunk@QHashData@@QAEXXZ.QT5CORE ref: 6A6142EE
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000000,?,?,?,?,0000000C,?), ref: 6A614316
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Network$String@@$Configuration@@$Configuration$?disconnect@D01@Data@@HashHash@@Object@@$?default?identifier@Configuration@ManagerPrivate@@$?configuration@Manager@@Node@Session@@$??8@?allocate?free?has?rehash@?state@Array@@ByteConfiguration@@@@Flag@Flags@Mutex@@RecursiveReply@@Sequential@Shrunk@StateString@@0@V0@@Valid@
                                          • String ID:
                                          • API String ID: 3159698967-0
                                          • Opcode ID: d61710be0efc5447aac2842938b5ddb6f126946aba0e86ba0d9dc32972155a56
                                          • Instruction ID: c1803b186dae9edffef93435e0e4520ded770029f2305c3e99ab44aa27771fad
                                          • Opcode Fuzzy Hash: d61710be0efc5447aac2842938b5ddb6f126946aba0e86ba0d9dc32972155a56
                                          • Instruction Fuzzy Hash: 749190B56082059FCB04DFA4C8D8AAEBBF8AF95358F01081DF45687252DF35ED49CBA1
                                          Function 6A668B10 Relevance: 38.6, APIs: 21, Strings: 1, Instructions: 148stringtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QDataStream@@QAE@ABVQByteArray@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?), ref: 6A668B2F
                                          • ?setByteOrder@QDataStream@@QAEXW4ByteOrder@1@@Z.QT5CORE(00000001,?,?,?,?,?,?,?,?), ref: 6A668B3B
                                          • ?readRawData@QDataStream@@QAEHPADH@Z.QT5CORE(?,00000008,?,?,?,?,?,?,?,?), ref: 6A668B4C
                                          • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NTLMSSP,00000008,?,?,?,?,?,?,?,?), ref: 6A668B63
                                          • ??5QDataStream@@QAEAAV0@AAH@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?), ref: 6A668B82
                                          • ??5QDataStream@@QAEAAV0@AAH@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A668BA6
                                          • ?readRawData@QDataStream@@QAEHPADH@Z.QT5CORE(?,00000008,?,?,?,?,?,?,?,?,?,?,?), ref: 6A668BB2
                                          • ??5QDataStream@@QAEAAV0@AAH@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A668BC9
                                          • ??5QDataStream@@QAEAAV0@AAH@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A668BD1
                                          • ?mid@QByteArray@@QBE?AV1@HH@Z.QT5CORE(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A668C08
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A668C12
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A668C2A
                                          • ??0QString@@QAE@PBVQChar@@H@Z.QT5CORE(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A668C36
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A668C40
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A668C4E
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A668C58
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DataStream@@$Byte$Array@@$?begin@?readData@String@@$?mid@?setArray@@@Char@@DateOrder@Order@1@@Time@@V0@$$V0@@strncmp
                                          • String ID: NTLMSSP
                                          • API String ID: 1840764726-2117951897
                                          • Opcode ID: 0bef7d3cc80e54779f58334977ce7e384798a8375f63a7841708a631ea576103
                                          • Instruction ID: 63a4e9adac6fda52104d7b5c277797a98870136ba87ca735588fda6ebaf713a0
                                          • Opcode Fuzzy Hash: 0bef7d3cc80e54779f58334977ce7e384798a8375f63a7841708a631ea576103
                                          • Instruction Fuzzy Hash: 3A515D72101206AFCB04DF61C8989AABBF8FF96345F415819F546C3150EB30FA5ACBA2
                                          Function 6A658A20 Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 145networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(Accept-Ranges,000000FF,?,?,00000000), ref: 6A658A6B
                                          • ?hasRawHeader@QNetworkReply@@QBE_NABVQByteArray@@@Z.QT5NETWORK(?), ref: 6A658A76
                                          • ?rawHeader@QNetworkReply@@QBE?AVQByteArray@@ABV2@@Z.QT5NETWORK(?,?,?), ref: 6A658A8D
                                            • Part of subcall function 6A622940: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(08244C89,6A656BD9,6A656BD9,?,6A656BD9,?,?,?,?,?,?,?,6A65BB16,?), ref: 6A622979
                                          • ?qstrcmp@@YAHABVQByteArray@@PBD@Z.QT5CORE(00000000,none,?,?,?), ref: 6A658A9D
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A658ABD
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(Range,000000FF), ref: 6A658AD5
                                          • ?hasRawHeader@QNetworkRequest@@QBE_NABVQByteArray@@@Z.QT5NETWORK(?), ref: 6A658AE4
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?), ref: 6A658AEF
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(Range,000000FF), ref: 6A658B04
                                          • ?rawHeader@QNetworkRequest@@QBE?AVQByteArray@@ABV2@@Z.QT5NETWORK(?,?), ref: 6A658B16
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?), ref: 6A658B1F
                                          • ?startsWith@QByteArray@@QBE_NPBD@Z.QT5CORE(bytes=), ref: 6A658B2E
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A658B3C
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A658B46
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A658B55
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A658B68
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(?,_q_startOperation,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6A658C07
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$Array@@$Header@Network$?has?rawArray@@@GenericObject@@Reply@@Request@@V2@@$?invoke?qstrcmp@@?startsArgument@@Argument@@444444444@ConnectionMetaMethod@Qt@@ReturnType@V0@@With@
                                          • String ID: Accept-Ranges$Range$_q_startOperation$bytes=$none
                                          • API String ID: 2561595089-680470801
                                          • Opcode ID: 7b5cd0f98c56e51d4a0c39d045ae3883322588b5c0057253f2dd029b960e59e1
                                          • Instruction ID: ea91989576981767cd6fc5f60f980ba769efe989d36dcbd51804c710d9af8a5b
                                          • Opcode Fuzzy Hash: 7b5cd0f98c56e51d4a0c39d045ae3883322588b5c0057253f2dd029b960e59e1
                                          • Instruction Fuzzy Hash: C44160B11183019BD714DF64C894BDAB7F8FF45318F01491DE5AB931A1EF34A948CB62
                                          Function 6A6AAAE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 232COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?indexOf@QByteArray@@QBEHPBDH@Z.QT5CORE(-----BEGIN CERTIFICATE-----,00000000,?,?,?,?,?,?,00000001,?,?,?,6A6932E2,00000000,?), ref: 6A6AAB25
                                          • ?at@QByteArray@@QBEDH@Z.QT5CORE(?,?,?,?,?,?,?,00000001,?,?,?,6A6932E2,00000000,?), ref: 6A6AAB43
                                          • ?at@QByteArray@@QBEDH@Z.QT5CORE(?,?,?,?,?,?,?,00000001,?,?,?,6A6932E2,00000000,?), ref: 6A6AAB7B
                                          • ?indexOf@QByteArray@@QBEHPBDH@Z.QT5CORE(-----END CERTIFICATE-----,?,?,?,?,?,?,?,00000001,?,?,?,6A6932E2,00000000,?), ref: 6A6AAB95
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,?,?,?,?,00000001,?,?,?,6A6932E2,00000000,?), ref: 6A6AABC4
                                          • ?fromRawData@QByteArray@@SA?AV1@PBDH@Z.QT5CORE(?,00000000,00000000,?,?,?,?,?,?,?,00000001,?,?,?,6A6932E2,00000000), ref: 6A6AABD5
                                          • ?fromBase64@QByteArray@@SA?AV1@ABV1@@Z.QT5CORE(?,00000000,?,?,?,?,?,?,?,00000001,?,?,?,6A6932E2,00000000,?), ref: 6A6AABE1
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6AABEE
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE ref: 6A6AABF8
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(?,00000001), ref: 6A6AAC6D
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK ref: 6A6AACA3
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK ref: 6A6AACE7
                                          • ??1QSslCertificate@@QAE@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6A6AAD35
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?), ref: 6A6AAD3F
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A6AAD60
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(00000000), ref: 6A6AAD6C
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(00000000), ref: 6A6AAD73
                                          • ??1QSslCertificate@@QAE@XZ.QT5NETWORK ref: 6A6AAD83
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6AAD98
                                          Strings
                                          • -----END CERTIFICATE-----, xrefs: 6A6AAB90
                                          • -----BEGIN CERTIFICATE-----, xrefs: 6A6AAB20
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$Certificate@@$V0@@$Data@@List$?at@?from?index$?append@?begin@?data@?detach_grow@?dispose@Base64@Char@@Data@Data@1@Data@1@@String@@V1@@
                                          • String ID: -----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----
                                          • API String ID: 455275468-2949388839
                                          • Opcode ID: 9042216b740d81b2ee7a7157b9e875a50f854dc43f0e795233bd4b2e0088f0da
                                          • Instruction ID: 783b5cae6ab828112dfbb681c05a076bf66569869456bd7de2be8dadfed0cd3d
                                          • Opcode Fuzzy Hash: 9042216b740d81b2ee7a7157b9e875a50f854dc43f0e795233bd4b2e0088f0da
                                          • Instruction Fuzzy Hash: 6D91C0B25042059FCB00DF18C884A6EB7F5BF85304F46451EFA6A97291DF31ED06CB91
                                          Function 6A656B90 Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 95networktimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(location,000000FF,6BBE0EA0,?,?,?,?,?,6A65BB16,?), ref: 6A656BC2
                                          • ?rawHeader@QNetworkReply@@QBE?AVQByteArray@@ABV2@@Z.QT5NETWORK(?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656BD4
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656BDD
                                          • ?fromUtf8@QString@@SA?AV1@ABVQByteArray@@@Z.QT5CORE(?,?,00000000,?,?,?,?,?,6A65BB16,?), ref: 6A656BEF
                                          • ??0QUrl@@QAE@ABVQString@@W4ParsingMode@0@@Z.QT5CORE(00000000,?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656BFD
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656C07
                                          • ?isValid@QUrl@@QBE_NXZ.QT5CORE(?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656C11
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656C28
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656C52
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(00000000,00000000,?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656C5E
                                          • ??0QUrl@@QAE@ABVQString@@W4ParsingMode@0@@Z.QT5CORE(?,00000000,?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656C6F
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000,?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656C7A
                                          • ??1QUrl@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656C84
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656C8E
                                          • ??0QVariant@@QAE@ABVQUrl@@@Z.QT5CORE(?,?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656C9F
                                          • ?setAttribute@QNetworkReply@@IAEXW4Attribute@QNetworkRequest@@ABVQVariant@@@Z.QT5NETWORK(00000002,?,?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656CAE
                                          • ??1QVariant@@QAE@XZ.QT5CORE(00000002,?,?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656CB7
                                          • ??1QUrl@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656CC1
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,6A65BB16,?), ref: 6A656CCB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$ByteUrl@@$Array@@$Network$?data@Attribute@Char@@Mode@0@@ParsingReply@@Variant@@$?from?raw?setArray@@@DateHeader@Latin1Request@@String@@@Time@@Url@@@Utf8@V0@$$V0@@V2@@Valid@Variant@@@
                                          • String ID: location
                                          • API String ID: 3970238620-1587448267
                                          • Opcode ID: d82408b1cb3a70f66300dabf40e91ff0ffa377da24ebd7057e5e658fba380751
                                          • Instruction ID: 5b25f9e65f71a179a71fcb059df6627e94d233a3f83b3103df4fd6c2eb39b8bf
                                          • Opcode Fuzzy Hash: d82408b1cb3a70f66300dabf40e91ff0ffa377da24ebd7057e5e658fba380751
                                          • Instruction Fuzzy Hash: 4A314FB51042469FCB04DF61C958DAAB7F8FF96209F05491DF49BC2091EF30AE09CB62
                                          Function 6A680340 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 246windownetworkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?lookupId@QHostInfo@@QBEHXZ.QT5NETWORK(?,?), ref: 6A68037D
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000,?,?), ref: 6A680394
                                          • ?lookupId@QHostInfo@@QBEHXZ.QT5NETWORK(?,?), ref: 6A6803A6
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QAbstractSocketPrivate::_q_startConnecting() received hostInfo for wrong lookup ID %d expected %d,00000000,000000FF,?,?), ref: 6A6803B3
                                          • ?addresses@QHostInfo@@QBE?AV?$QList@VQHostAddress@@@@XZ.QT5NETWORK(?,?,?), ref: 6A6803DF
                                          • ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK(?,?), ref: 6A680408
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?,?), ref: 6A680435
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,?), ref: 6A68044D
                                          • ?addresses@QHostInfo@@QBE?AV?$QList@VQHostAddress@@@@XZ.QT5NETWORK(?,?,?), ref: 6A680482
                                          • ?append@QListData@@QAEPAPAXABU1@@Z.QT5CORE(?,?,6BD7498C,?,?), ref: 6A680520
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Host not found,00000000,000000FF,?,6BD7498C,?,?), ref: 6A680573
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?,?,?), ref: 6A68058B
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?), ref: 6A680595
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(?,?,00000003,?,?,?), ref: 6A6805CC
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(?,?,00000005,?,?,?), ref: 6A6805F3
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(?,?,00000003,?,?,6BD7498C,?,?), ref: 6A68063B
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(?,?,00000000,00000000,?,?), ref: 6A680647
                                            • Part of subcall function 6A680020: ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,?,?,6BC7FE10,?,?), ref: 6A680059
                                            • Part of subcall function 6A680020: ??1QHostAddress@@QAE@XZ.QT5NETWORK(?,?,?,?,6BC7FE10,?,?), ref: 6A6800B3
                                            • Part of subcall function 6A680020: ?erase@QListData@@QAEPAPAXPAPAX@Z.QT5CORE(?,?,?,?,?,6BC7FE10,?,?), ref: 6A6800C6
                                            • Part of subcall function 6A680020: ??1QHostAddress@@QAE@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,?,6A6814CC), ref: 6A6800E6
                                            • Part of subcall function 6A680020: ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK ref: 6A6800F6
                                          Strings
                                          • Host not found, xrefs: 6A68055A
                                          • QAbstractSocketPrivate::_q_startConnecting() received hostInfo for wrong lookup ID %d expected %d, xrefs: 6A6803AD
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Host$Object@@$Meta$?activate@Address@@Info@@$Data@@ListString@@V0@@$?addresses@?append@?lookup?protocol@AbstractAddress@@@@Authenticator@@LayerList@Logger@@MessageNetworkProtocol@SharedSocket@@$?erase@?tr@?warning@U1@@
                                          • String ID: Host not found$QAbstractSocketPrivate::_q_startConnecting() received hostInfo for wrong lookup ID %d expected %d
                                          • API String ID: 3137283406-3915677362
                                          • Opcode ID: 0cc4dcd385d6d9ceca058d37f63e9e42cdf85eae851396003bff2263411557ee
                                          • Instruction ID: 95bce54be4a9b3a76dbee2839ae44ab41f759e8439651e397fe61430d2ce9918
                                          • Opcode Fuzzy Hash: 0cc4dcd385d6d9ceca058d37f63e9e42cdf85eae851396003bff2263411557ee
                                          • Instruction Fuzzy Hash: B4916BB0204244DBDB10CF68C884B6A77F8FF85724F164A29F95A9B291DF31ED05CB62
                                          Function 6A67E370 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 188COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(?,?,00000000,00000001), ref: 6A67E3A0
                                          • ?indexOf@QString@@QBEHVQChar@@HW4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000000,00000001), ref: 6A67E3A8
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(?,?,00000000,00000001,?,00000000,00000001), ref: 6A67E3B6
                                          • ?indexOf@QString@@QBEHVQChar@@HW4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000000,00000001,?,00000000,00000001), ref: 6A67E3BE
                                          • ?mid@QString@@QBE?AV1@HH@Z.QT5CORE(?,00000001,00000000,?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E3F4
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(00000020,00000001,?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E439
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E463
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E4A3
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E4F5
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E500
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,6A702ECC,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6A67E51E
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000001), ref: 6A67E532
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000000,?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E545
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E54F
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000001,00000001,?,00000000,00000001,?,00000000,00000001), ref: 6A67E55F
                                          • ?mid@QString@@QBE?AV1@HH@Z.QT5CORE(?,?,000000FF,?,00000000,00000001,?,00000000,00000001), ref: 6A67E57E
                                          • ??1QString@@QAE@XZ.QT5CORE(00000000,?,00000000,00000001,?,00000000,00000001), ref: 6A67E592
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Array@@ByteChar@@V0@@$Data@@List$?index?mid@CaseChar@@@Latin1Qt@@@Sensitivity@$?append@?detach_grow@?dispose@Data@1@Data@1@@
                                          • String ID: $;
                                          • API String ID: 4112344663-2280626032
                                          • Opcode ID: b3ac6320b2d02846665df99d4d5aa22ae304260a2d9c4dc3bfcf7de7436ec58e
                                          • Instruction ID: 37e4fdcb9df256f2711c8a75613d44affe4484532050400f1ac74c73a6a7fcbe
                                          • Opcode Fuzzy Hash: b3ac6320b2d02846665df99d4d5aa22ae304260a2d9c4dc3bfcf7de7436ec58e
                                          • Instruction Fuzzy Hash: 8571BDB15043158FCB10DF19C8949AAB7F1BF86328F160A1CF96A97291EF31ED49CB81
                                          Function 6A6B60D0 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 154COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6A0030: ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A0043
                                            • Part of subcall function 6A6A0030: ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A005E
                                            • Part of subcall function 6A6A0030: ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,BIO_meth_new), ref: 6A6A006F
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ?writeNotification@QTcpServerPrivate@@UAEXXZ.QT5NETWORK(00000000,00000000,00000001,00000014,00000515,qdtlsbio,?,?,?,?,?), ref: 6A6B6126
                                          • ?writeNotification@QTcpServerPrivate@@UAEXXZ.QT5NETWORK(00000000,00000000,00000000,00000000,00000001,00000014,00000515,qdtlsbio,?,?,?,?,?), ref: 6A6B6131
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,%1 failed,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,?), ref: 6A6B614F
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(00000020), ref: 6A6B6161
                                          • ?arg@QString@@QBE?AV1@VQLatin1String@@HVQChar@@@Z.QT5CORE(?,0000000C,BIO_meth_new,00000000), ref: 6A6B6178
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6B6182
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(00000020), ref: 6A6B6198
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6B61A2
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,%1 failed,00000000,000000FF), ref: 6A6B6214
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(00000020), ref: 6A6B6226
                                          • ?arg@QString@@QBE?AV1@VQLatin1String@@HVQChar@@@Z.QT5CORE(?,00000007,BIO_new,00000000), ref: 6A6B623E
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6B6248
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A6B625E
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6B6268
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Char@@@Latin1$?arg@?tr@?writeChar@@Logger@@MessageMetaNotification@Object@@Private@@ServerV0@@$?warning@Category@@Enabled@H00@LoggingWarningmalloc
                                          • String ID: $%1 failed$BIO_meth_new$BIO_new$qdtlsbio
                                          • API String ID: 599396495-1353390181
                                          • Opcode ID: a5880666ba57e35f33ef76593c17e27dee0e8fb9eb52c0aecb98a1ee946c0cf7
                                          • Instruction ID: 3a008f7438fb20d9662265647aab249380b02e73cbf30c999e528c838c2d7737
                                          • Opcode Fuzzy Hash: a5880666ba57e35f33ef76593c17e27dee0e8fb9eb52c0aecb98a1ee946c0cf7
                                          • Instruction Fuzzy Hash: 0851A0B0104341ABD711DF64CD48F9BBBF8AB89718F02051CF58AA6292DF34ED15CBA6
                                          Function 6A66AA10 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 136timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?simplified@QString@@QGBE?AV1@XZ.QT5CORE(6BBE0EA0,6BBE0EA0,?,?,?,?,?,?,?,?,?,?,6A66B6E3,?,00000000,6A6732E4), ref: 6A66AA30
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(0000003A), ref: 6A66AA51
                                          • ?indexOf@QString@@QBEHVQChar@@HW4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000000,00000001), ref: 6A66AA63
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(00000025,?,000000FF,?,?,00000001), ref: 6A66AA9D
                                          • ?lastIndexOf@QStringRef@@QBEHVQChar@@HW4CaseSensitivity@Qt@@@Z.QT5CORE(?,000000FF,?,?,00000001), ref: 6A66AAA7
                                          • ?mid@QStringRef@@QBE?AV1@HH@Z.QT5CORE(?,00000001,000000FF,?,000000FF,?,?,00000001), ref: 6A66AAC3
                                          • ?toString@QStringRef@@QBE?AVQString@@XZ.QT5CORE(0000003A,?,000000FF,?,?,00000001), ref: 6A66AAD0
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000,?,000000FF,?,?,00000001), ref: 6A66AADA
                                          • ??1QString@@QAE@XZ.QT5CORE(?,000000FF,?,?,00000001), ref: 6A66AAE4
                                          • ?clear@QString@@QAEXXZ.QT5CORE(?,000000FF,?,?,00000001), ref: 6A66AB0F
                                          • ?constEnd@QStringRef@@QBEPBVQChar@@XZ.QT5CORE(?,000000FF,?,?,00000001), ref: 6A66AB19
                                          • ?constData@QStringRef@@QBEPBVQChar@@XZ.QT5CORE(?,000000FF,?,?,00000001), ref: 6A66AB25
                                          • ?parseIp6@QIPAddressUtils@@YAPBVQChar@@AAY0BA@EPBV2@1@Z.QT5CORE(?,00000000,00000000,?,000000FF,?,?,00000001), ref: 6A66AB32
                                          • ?constEnd@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A66AB5B
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A66AB67
                                          • ?parseIp4@QIPAddressUtils@@YA_NAAIPBVQChar@@1@Z.QT5CORE(?,00000000,00000000), ref: 6A66AB74
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,6A66B6E3,?,00000000,6A6732E4,?), ref: 6A66ABC6
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Char@@$String@@$Ref@@String$?const$?parseAddressCaseChar@@@End@Latin1Qt@@@Sensitivity@Utils@@$?clear@?data@?index?last?mid@?simplified@Char@@1@Data@DateIndexIp4@Ip6@String@Time@@V0@$$V0@@V2@1@
                                          • String ID: %$:
                                          • API String ID: 3713537-4129514765
                                          • Opcode ID: 527e6a25665babfb98c3b2b8cbaacd46993d4206fb2da3f32a9190c7fed8d975
                                          • Instruction ID: 983e4c64ca34cbedf647075fe9c1eeef8890673712821e37aeb0eea6a139c977
                                          • Opcode Fuzzy Hash: 527e6a25665babfb98c3b2b8cbaacd46993d4206fb2da3f32a9190c7fed8d975
                                          • Instruction Fuzzy Hash: 3E515CB1108342AFCB04DF65C958B9ABBF5BB99314F415A1DF4A6C3290DB34E909CF92
                                          Function 6A634390 Relevance: 33.1, APIs: 22, Instructions: 140networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QNetworkCacheMetaData@@QAE@XZ.QT5NETWORK(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A6335B0,00000000), ref: 6A63439D
                                            • Part of subcall function 6A6278D0: ??0QMutex@@QAE@XZ.QT5CORE(6A657FD2,?,?,?,?,?,?,?,?,?,?,?,?,?,6A65B483), ref: 6A6278E2
                                            • Part of subcall function 6A6278D0: ??0QMutex@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,6A65B483), ref: 6A6278EB
                                            • Part of subcall function 6A6278D0: ??0QDateTime@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,6A65B483), ref: 6A6278F4
                                            • Part of subcall function 6A6278D0: ??0QDateTime@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,6A65B483), ref: 6A6278FD
                                          • ??1QNetworkCacheMetaData@@QAE@XZ.QT5NETWORK(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A6335B0,00000000), ref: 6A6343AE
                                          • ??0QDataStream@@QAE@PAVQIODevice@@@Z.QT5CORE(?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A6335B0,00000000,00000001), ref: 6A6343DC
                                          • ??5QDataStream@@QAEAAV0@AAH@Z.QT5CORE(?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A6335B0,00000000,00000001), ref: 6A6343F1
                                          • ??5QDataStream@@QAEAAV0@AAH@Z.QT5CORE(?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A6335B0,00000000,00000001), ref: 6A6343FC
                                          • ??5QDataStream@@QAEAAV0@AAH@Z.QT5CORE(?), ref: 6A63441F
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A63443A
                                          • ??5@YAAAVQDataStream@@AAV0@AAVQNetworkCacheMetaData@@@Z.QT5NETWORK(?,?), ref: 6A634446
                                          • ??5QDataStream@@QAEAAV0@AA_N@Z.QT5CORE(?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A6335B0,00000000,00000001), ref: 6A634457
                                          • ??5@YAAAVQDataStream@@AAV0@AAVQByteArray@@@Z.QT5CORE(?,?), ref: 6A634475
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A6335B0,00000000), ref: 6A634489
                                          • ?qUncompress@@YA?AVQByteArray@@PBEH@Z.QT5CORE(?,00000000,?,?,?,?,00000000), ref: 6A634496
                                          • ?setData@QBuffer@@QAEXABVQByteArray@@@Z.QT5CORE(?,?,?,?,?,?,?,00000000), ref: 6A6344A6
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,00000000), ref: 6A6344B0
                                          • ?url@QNetworkCacheMetaData@@QBE?AVQUrl@@XZ.QT5NETWORK(00000000), ref: 6A6344CF
                                          • ??1QUrl@@QAE@XZ.QT5CORE(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A6335B0,00000000), ref: 6A6344E6
                                          • ?endsWith@QString@@QBE_NABV1@W4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000001,?,?,?,00000000), ref: 6A634502
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A6335B0,00000000), ref: 6A63450E
                                          • ?isValid@QNetworkCacheMetaData@@QBE_NXZ.QT5NETWORK(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A6335B0,00000000), ref: 6A63451A
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A6335B0,00000000), ref: 6A634525
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A6335B0,00000000), ref: 6A63452F
                                          • ??1QDataStream@@QAE@XZ.QT5CORE(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A6335B0,00000000), ref: 6A634539
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DataStream@@$ByteCacheMetaNetworkString@@$Data@@$Array@@$??5@Array@@@DateMutex@@Time@@Url@@$?data@?ends?set?url@Buffer@@CaseChar@@Data@Data@@@Device@@@Qt@@@Sensitivity@Uncompress@@Valid@With@
                                          • String ID:
                                          • API String ID: 1234227417-0
                                          • Opcode ID: 72a9799e91a57fe6fc1e44e1f11b76e6b481554dbb6042121afe1d34ffe5c427
                                          • Instruction ID: f762248366d18b0cacdf89d2e6ebd8603542d23d3ba1dec28517224e17efc489
                                          • Opcode Fuzzy Hash: 72a9799e91a57fe6fc1e44e1f11b76e6b481554dbb6042121afe1d34ffe5c427
                                          • Instruction Fuzzy Hash: 465128B1504206AFCB04DF61C898E9ABBF8EF99315F015929F556C3291DB31E909CF52
                                          Function 6A688BA0 Relevance: 33.1, APIs: 22, Instructions: 128COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QHostAddress@@QAE@XZ.QT5NETWORK(?,?,?,00000000,?,?,00000001), ref: 6A688BAD
                                            • Part of subcall function 6A669DD0: ??0QMutex@@QAE@XZ.QT5CORE(6A699B97), ref: 6A669DE2
                                            • Part of subcall function 6A669DD0: ??0QString@@QAE@XZ.QT5CORE ref: 6A669DEB
                                          • ??4QHostAddress@@QAEAAV0@ABV0@@Z.QT5NETWORK(?,?,?,?,00000000,?,?,00000001), ref: 6A688BC6
                                            • Part of subcall function 6A669E40: ??1QString@@QAE@XZ.QT5CORE(?,?,6A67128E,?,00000000,?,00000000,?,?,00000000,?,?,6BB6C190,?,?), ref: 6A669E6D
                                          • ??4QHostAddress@@QAEAAV0@ABV0@@Z.QT5NETWORK(?), ref: 6A688BE8
                                          • ??0QString@@QAE@XZ.QT5CORE(?), ref: 6A688BF5
                                          • ?reserve@QByteArray@@QAEXH@Z.QT5CORE(0000010E), ref: 6A688C04
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(00000005), ref: 6A688C16
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(00000002), ref: 6A688C20
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(00000000), ref: 6A688C28
                                          • ?toAce@QUrl@@SA?AVQByteArray@@ABVQString@@@Z.QT5CORE(00000002,?), ref: 6A688C69
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(00000003,?,00000000,?,?,00000001), ref: 6A688C8E
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(000000FF,?,00000000,?,?,00000001), ref: 6A688C9D
                                          • ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(?,?,00000000,?,?,00000001), ref: 6A688CAE
                                          • ?fromRawData@QByteArray@@SA?AV1@PBDH@Z.QT5CORE(?,?,00000002,?,00000000,?,?,00000001), ref: 6A688CC5
                                          • ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(00000000,?,?,?,?,?,?,?,00000001), ref: 6A688CD3
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,00000001), ref: 6A688CD9
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,00000001), ref: 6A688CE3
                                          • ??0QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,00000001), ref: 6A688CED
                                          • ?write@QIODevice@@QAE_JABVQByteArray@@@Z.QT5CORE(?), ref: 6A688D12
                                          • ?flush@QSslSocket@@QAE_NXZ.QT5NETWORK ref: 6A688D1D
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A688D2D
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A688D37
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK ref: 6A688D41
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$Array@@$?append@$Address@@HostString@@$V0@@V1@@$?flush@?from?reserve@?write@Ace@Array@@@Data@Device@@Mutex@@Socket@@String@@@Url@@
                                          • String ID:
                                          • API String ID: 2748733514-0
                                          • Opcode ID: 6984a5571af029ead73de46ea779926581c087cdd04130d243bb86e58c1d4dda
                                          • Instruction ID: f910d1b454aab8f9da52b6e94a4dc6e8ba59b87eec6a8694094d41c5b60d17cf
                                          • Opcode Fuzzy Hash: 6984a5571af029ead73de46ea779926581c087cdd04130d243bb86e58c1d4dda
                                          • Instruction Fuzzy Hash: 3651F8B10042069FC704DF55C898E9ABBF8FFA5349F41481DF586971A1EB34EA4DCBA2
                                          Function 6A67AAD0 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 180networkwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?allInterfaces@QNetworkInterface@@SA?AV?$QList@VQNetworkInterface@@@@XZ.QT5NETWORK(?,?,?,?,?,?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67AADC
                                            • Part of subcall function 6A670360: ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(?,?,?,?,6BB6C190,?,?,?,?), ref: 6A6703C1
                                            • Part of subcall function 6A670360: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,?,?,?,?,?), ref: 6A67042C
                                          • ?addressEntries@QNetworkInterface@@QBE?AV?$QList@VQNetworkAddressEntry@@@@XZ.QT5NETWORK(?,?,?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67AB09
                                          • ?ip@QNetworkAddressEntry@@QBE?AVQHostAddress@@XZ.QT5NETWORK(?,?,?,?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67AB2F
                                            • Part of subcall function 6A670E50: ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,6A67D209,?,?,?), ref: 6A670E56
                                          • ?isEqual@QHostAddress@@QBE_NABV1@V?$QFlags@W4ConversionModeFlag@QHostAddress@@@@@Z.QT5NETWORK(?,?,?,?,?,?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67AB43
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK(?,?,?,?,?,?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67AB4E
                                            • Part of subcall function 6A669E10: ??1QString@@QAE@XZ.QT5CORE(00000000,6A6ABD95,?), ref: 6A669E29
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67AB97
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67ABD1
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,Could not find the interface for the local address.,?,?,?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67ABDD
                                          • ??0QNetworkProxyQuery@@QAE@XZ.QT5NETWORK(?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67ABEC
                                          • ??1QNetworkInterface@@QAE@XZ.QT5NETWORK(?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67AC45
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67AC4F
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,?,?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67AC69
                                          • ??1QNetworkInterface@@QAE@XZ.QT5NETWORK(?,?,?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67ACB5
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,?,?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67ACBF
                                          • ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.monitor,?,?,?,?,6A67B7A1,?,?,00000000,?,?,?), ref: 6A67ACF6
                                          • __Init_thread_footer.LIBCMT ref: 6A67AD0B
                                          Strings
                                          • qt.network.monitor, xrefs: 6A67ACEC
                                          • Could not find the interface for the local address., xrefs: 6A67ABD7
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Network$Data@@HostInterface@@List$?dispose@Address@@Data@1@@$AddressAuthenticator@@Category@@List@Logger@@LoggingMessageSharedV0@@$?address?all?detach@?ip@?warning@Address@@@@@ConversionData@1@Enabled@Entries@Entry@@Entry@@@@Equal@Flag@Flags@H00@Init_thread_footerInterface@@@@Interfaces@ModeProxyQuery@@String@@Warning
                                          • String ID: Could not find the interface for the local address.$qt.network.monitor
                                          • API String ID: 3379184512-146285588
                                          • Opcode ID: 1de688b5f0b3ae938a616e6ea3ac4d7049b96b6b0c3887abd4a10bef98c79b12
                                          • Instruction ID: b22325ad828a9c591f800e85ec3529eb9a9d3eb8e1c53067c37f87eb18642944
                                          • Opcode Fuzzy Hash: 1de688b5f0b3ae938a616e6ea3ac4d7049b96b6b0c3887abd4a10bef98c79b12
                                          • Instruction Fuzzy Hash: 9D5116B16002059FDB20DF58D884A5E73E2FF81328F460528E92697391EF31FD09CB96
                                          Function 6A628290 Relevance: 30.2, APIs: 20, Instructions: 211timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QUrl@@QAE@ABV0@@Z.QT5CORE(?,?,?,?,?,?,6A627D6D,?,?), ref: 6A6282A3
                                          • ??6@YAAAVQDataStream@@AAV0@ABVQUrl@@@Z.QT5CORE(?,?,?,?,?,?,?,?,6A627D6D,?,?), ref: 6A6282B3
                                          • ??1QUrl@@QAE@XZ.QT5CORE ref: 6A6282C0
                                          • ??0QDateTime@@QAE@ABV0@@Z.QT5CORE(-0000000C), ref: 6A6282D6
                                          • ??6@YAAAVQDataStream@@AAV0@ABVQDateTime@@@Z.QT5CORE(?,?), ref: 6A6282E4
                                          • ??1QDateTime@@QAE@XZ.QT5CORE ref: 6A6282F3
                                          • ??0QDateTime@@QAE@ABV0@@Z.QT5CORE(-00000008), ref: 6A628303
                                          • ??6@YAAAVQDataStream@@AAV0@ABVQDateTime@@@Z.QT5CORE(?,?), ref: 6A62830B
                                          • ??1QDateTime@@QAE@XZ.QT5CORE ref: 6A628314
                                          • ??6QDataStream@@QAEAAV0@_N@Z.QT5CORE(?), ref: 6A628323
                                          • ??6QDataStream@@QAEAAV0@H@Z.QT5CORE(?), ref: 6A628365
                                          • ??6QDataStream@@QAEAAV0@H@Z.QT5CORE(?), ref: 6A62838A
                                          • ??6@YAAAVQDataStream@@AAV0@ABVQVariant@@@Z.QT5CORE(00000000,?), ref: 6A628393
                                          • ?nextNode@QHashData@@SAPAUNode@1@PAU21@@Z.QT5CORE(?), ref: 6A62839A
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A61A7F0), ref: 6A6283D0
                                          • ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(?), ref: 6A6283F4
                                          • ??6QDataStream@@QAEAAV0@H@Z.QT5CORE(?), ref: 6A628443
                                          • ??6@YAAAVQDataStream@@AAV0@ABVQByteArray@@@Z.QT5CORE(?,?,?), ref: 6A628478
                                          • ??6@YAAAVQDataStream@@AAV0@ABVQByteArray@@@Z.QT5CORE(00000000), ref: 6A62847E
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,?), ref: 6A6284CE
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DataStream@@$??6@Date$Data@@Time@@$V0@@$Array@@@ByteHashListTime@@@Url@@$?detach@?dispose@?free_helper@?nextData@1@Data@1@@Node@Node@1@Node@1@@U21@@Url@@@V0@_Variant@@@
                                          • String ID:
                                          • API String ID: 2038424903-0
                                          • Opcode ID: b53760f878b4b4a67e0b3cc88d160f3bc57dafabf3424fd106b71f8c1f34db8f
                                          • Instruction ID: df9335f405e13e22a495e96ce7749508db13fac3c3993e816c74fcd9707b5157
                                          • Opcode Fuzzy Hash: b53760f878b4b4a67e0b3cc88d160f3bc57dafabf3424fd106b71f8c1f34db8f
                                          • Instruction Fuzzy Hash: 00715C711042069FDB10DFA8CC8496AB3F8FF89324B06495DE966D72A1EB30F919CF61
                                          Function 6A64A170 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 135networktimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A64A186
                                          • ?capabilities@QNetworkProxy@@QBE?AV?$QFlags@W4Capability@QNetworkProxy@@@@XZ.QT5NETWORK(?), ref: 6A64A194
                                          • ?capabilities@QNetworkProxy@@QBE?AV?$QFlags@W4Capability@QNetworkProxy@@@@XZ.QT5NETWORK(?,?), ref: 6A64A1B1
                                          • ?hostName@QNetworkProxy@@QBE?AVQString@@XZ.QT5NETWORK(?,?,?), ref: 6A64A1C9
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000,?,?,?), ref: 6A64A1D3
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A64A1DD
                                          • ??0QHostAddress@@QAE@XZ.QT5NETWORK(?,?), ref: 6A64A1E7
                                          • ?setAddress@QHostAddress@@QAE_NABVQString@@@Z.QT5NETWORK(?,?,?), ref: 6A64A1F5
                                          • ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK(?,?,?), ref: 6A64A206
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(?,_q_startNextRequest,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6A64A236
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(?,_q_startNextRequest,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6A64A28A
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK ref: 6A64A2DE
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A64A2E7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Network$Address@@GenericHostObject@@$Proxy@@String@@$?capabilities@?invokeArgument@@Argument@@444444444@Capability@ConnectionFlags@MetaMethod@Proxy@@@@Qt@@ReturnType@V0@@$?host?protocol@?setAbstractAddress@Array@@ByteDateLayerName@Protocol@Socket@@String@@@Time@@V0@$$
                                          • String ID: 1_q_hostLookupFinished(QHostInfo)$_q_startNextRequest
                                          • API String ID: 61733990-627015283
                                          • Opcode ID: 13febbcde64e981e5855aa1926a519736a3b1140c165c66a15e1008654b699ee
                                          • Instruction ID: 916981d90e8f0bd6115d910a28b132f7ef6d13c60059df9fe518a237cf6a91dd
                                          • Opcode Fuzzy Hash: 13febbcde64e981e5855aa1926a519736a3b1140c165c66a15e1008654b699ee
                                          • Instruction Fuzzy Hash: 40315BB1004305ABD711DF54CA98F9BBBE8EFA1708F41482DE58792192EF31E948CB27
                                          Function 6A64EB60 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 109COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QObjectPrivate@@QAE@H@Z.QT5CORE(00050F02,?,00000000,00000000), ref: 6A64EB7E
                                            • Part of subcall function 6A64E320: ??0QMutex@@QAE@XZ.QT5CORE(00000000,6A6516D1,?,00000001,?,?,?,?,?,?,?,?,?,?,6A615CAB), ref: 6A64E323
                                            • Part of subcall function 6A64E320: ??0QUrl@@QAE@ABV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,6A615CAB,?,?,?,?), ref: 6A64E330
                                          • ??0QMutex@@QAE@XZ.QT5CORE ref: 6A64EBAB
                                            • Part of subcall function 6A6516B0: ??0QString@@QAE@XZ.QT5CORE(?,00000001,?,?,?,?,?,?,?,?,?,?,6A615CAB,?,?,?), ref: 6A6516DB
                                            • Part of subcall function 6A6516B0: ??0QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,6A615CAB,?,?,?,?), ref: 6A651711
                                          • ??1QUrl@@QAE@XZ.QT5CORE(00000000), ref: 6A64EBBA
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A64EBDC
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A64EBE5
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A64EC18
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A64ED23
                                          • ??0QMutex@@QAE@XZ.QT5CORE ref: 6A64ED43
                                          • ?scheme@QUrl@@QBE?AVQString@@XZ.QT5CORE(?,?,00000001), ref: 6A64ED58
                                          • ??8QString@@QBE_NVQLatin1String@@@Z.QT5CORE(0000000F,preconnect-http,?,?,00000001), ref: 6A64ED6F
                                          • ??8QString@@QBE_NVQLatin1String@@@Z.QT5CORE(00000010,preconnect-https,?,?,00000001), ref: 6A64ED80
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,00000001), ref: 6A64ED8E
                                          • ??0QObject@@IAE@AAVQObjectPrivate@@PAV0@@Z.QT5CORE(00000000,?,?,?,00000001), ref: 6A64ED9B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Mutex@@Url@@$Latin1ObjectPrivate@@String@@@V0@@$?scheme@Object@@malloc
                                          • String ID: 4vlj$d$preconnect-http$preconnect-https
                                          • API String ID: 1882692906-3683033450
                                          • Opcode ID: 72e4784728dc6eb508fb9963509d9cd955679274a5a3506d6e1c871395bc4f79
                                          • Instruction ID: b0a2da517eb3843e9ac1a3f1207f6bc0a7bb36eeca91a99072fd879cbe045e4a
                                          • Opcode Fuzzy Hash: 72e4784728dc6eb508fb9963509d9cd955679274a5a3506d6e1c871395bc4f79
                                          • Instruction Fuzzy Hash: FD51B3B0004245CFEF44DF15C4A8B963BB4FF15318F0481A8ED5A4F29ADBBA6448CFA1
                                          Function 6A6983E0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 206memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,6A698868,?), ref: 6A69841A
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(00000000,00000000,?,?,?,?,?,?,?,?,6A698868,?), ref: 6A698430
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,6A698868,?), ref: 6A698512
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,6A698868,?), ref: 6A69851C
                                          • ?startsWith@QByteArray@@QBE_NPBD@Z.QT5CORE(1.2.840.113549.1.12.,?,?,?,?,?,?,?,?,?,?,?,6A698868,?), ref: 6A698583
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,6A698868,?), ref: 6A698597
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,6A698868,?), ref: 6A6985A1
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,6A698868,?), ref: 6A6985E4
                                          • ?allocate@QArrayData@@SAPAU1@IIIV?$QFlags@W4AllocationOption@QArrayData@@@@@Z.QT5CORE ref: 6A698653
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(lpj,00000004,00000004,00000006,00000000,?,?,?,?,?,?,?,?,?,6A698868,?), ref: 6A698679
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,6A698868,?), ref: 6A6986A5
                                          • __Init_thread_footer.LIBCMT ref: 6A6986BF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$String@@$?data@ArrayChar@@$?allocate@?startsAllocationData@@Data@@@@@Flags@Init_thread_footerOption@V0@@With@
                                          • String ID: 0$1.2.840.113549.1.12.$lpj$pj
                                          • API String ID: 3278404906-2435513882
                                          • Opcode ID: 91337cbf85662f58ebda56685ef7f2f621edf12327cb313e53c7d8a37cf37a04
                                          • Instruction ID: c533b1082832cd297c4f9973e0925947d6ca4f03a65790ced839141695ae57ea
                                          • Opcode Fuzzy Hash: 91337cbf85662f58ebda56685ef7f2f621edf12327cb313e53c7d8a37cf37a04
                                          • Instruction Fuzzy Hash: 1B81F3B15082428FDB40DF64C858A9ABFF0BF46324F46496CE696871A1DF31F90DCB96
                                          Function 6A666370 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 115COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??8@YA_NABVQString@@0@Z.QT5CORE(?,-00000014,?,?,?,?,?,?,?,?,?,?,?,6A66825F,?), ref: 6A666381
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6A66825F), ref: 6A6663AD
                                          • ??0QVariant@@QAE@ABVQString@@@Z.QT5CORE(-00000014,?,?,?,?,?,?,?,?,?,?,?,?,6A66825F,?), ref: 6A6663BD
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(00000005,realm,?,?,?,?,?,?,?,?,?,?,?,?,6A66825F,?), ref: 6A6663D3
                                          • ?qHash@@YAIABVQString@@I@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A66825F,?), ref: 6A6663EB
                                          • ?rehash@QHashData@@QAEXH@Z.QT5CORE(?,?,00000000), ref: 6A666428
                                          • ??0QVariant@@QAE@XZ.QT5CORE(?,?,00000000), ref: 6A666446
                                          • ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000008,?,?,00000000), ref: 6A666453
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,?,00000000), ref: 6A66646E
                                          • ??0QVariant@@QAE@ABV0@@Z.QT5CORE(00000000,?,?,00000000), ref: 6A66647A
                                          • ??1QVariant@@QAE@XZ.QT5CORE(?,?,00000000), ref: 6A666496
                                          • ??4QVariant@@QAEAAV0@$$QAV0@@Z.QT5CORE(?,?,00000000), ref: 6A6664AB
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A66825F,?), ref: 6A6664B5
                                          • ??1QVariant@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A66825F,?), ref: 6A6664BF
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,6A66825F,?), ref: 6A6664C7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Variant@@$String@@$V0@@$Data@@HashString@@@$??8@?allocate?rehash@Array@@ByteHash@@Latin1Node@String@@0@V0@$$
                                          • String ID: realm
                                          • API String ID: 2810126777-4204190682
                                          • Opcode ID: c67f40af9b0352673691266e76fd3f1aa866080e50b25dc0467278d9079dc8c8
                                          • Instruction ID: b4c0294c66c8bbd9bd2fc38e2919ac9e621f46a6fd1914f35c046956d3e9457e
                                          • Opcode Fuzzy Hash: c67f40af9b0352673691266e76fd3f1aa866080e50b25dc0467278d9079dc8c8
                                          • Instruction Fuzzy Hash: 0441F4B56042059FCB04DF65D89895ABBF8FF89349B11482EE88BC7241EB30AD09CB91
                                          Function 6A69A2D0 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 104COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?lock@QMutex@@QAEXXZ.QT5CORE ref: 6A69A2EB
                                          • ??8QSslCertificate@@QBE_NABV0@@Z.QT5NETWORK(?), ref: 6A69A325
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?,7FFFFFFF,00000001), ref: 6A69A37E
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A69A38A
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?), ref: 6A69A392
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?,7FFFFFFF,00000001), ref: 6A69A3D9
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE(?,7FFFFFFF,00000001), ref: 6A69A3E2
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A69A3F4
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?), ref: 6A69A3FC
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE ref: 6A69A408
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Certificate@@V0@@$?append@?unlock@Data@@ListLocker@@Mutex$?lock@Mutex@@
                                          • String ID: p/pj$p/pj$p/pj$p/pj$p/pj$p/pj
                                          • API String ID: 55967453-1905456606
                                          • Opcode ID: 0cf8f55cb10e786f3c292603acd261f4b3ac673e38ec98a1ec792341b0fc91af
                                          • Instruction ID: 66979e3c4fe5ec011de4bce62edb999d958ef0824d3b9213e28d1b12b29c5277
                                          • Opcode Fuzzy Hash: 0cf8f55cb10e786f3c292603acd261f4b3ac673e38ec98a1ec792341b0fc91af
                                          • Instruction Fuzzy Hash: E331D8726002018FC704DF64D9989A9F7F5FF55614B42456CE896D72A1EF30FC0ACA65
                                          Function 6A66E230 Relevance: 27.5, APIs: 18, Instructions: 452threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(?,00000010,00000000,?,00000000), ref: 6A66E2E8
                                          • memmove.VCRUNTIME140(?,00000000,?), ref: 6A66E31C
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000), ref: 6A66E33E
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,00000010,00000000,?,00000000), ref: 6A66E3CB
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(6BD7498C), ref: 6A66E3EC
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(-00000008,?,00000000,00000010,00000000,?,00000000), ref: 6A66E47D
                                          • ??8@YA_NABVQString@@0@Z.QT5CORE(?,?,?,00000000,00000010,00000000,?,00000000), ref: 6A66E4AB
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000000,00000010,00000000,?,00000000), ref: 6A66E4BF
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A66E4F1
                                          • ?prepend@QListData@@QAEPAPAXXZ.QT5CORE(?,00000000,00000010,00000000,?,00000000), ref: 6A66E512
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,?,?,?,00000000,00000010,00000000,?,00000000), ref: 6A66E5BE
                                          • ??8@YA_NABVQString@@0@Z.QT5CORE(?,?,?,?,?,?,00000000,00000010,00000000,?,00000000), ref: 6A66E5EC
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,00000000,00000010,00000000,?,00000000), ref: 6A66E604
                                          • ?maxThreadCount@QThreadPool@@QBEHXZ.QT5CORE(00000000,?,?,?,?,00000000,00000010,00000000,?,00000000), ref: 6A66E64E
                                          • ?start@QThreadPool@@QAEXPAVQRunnable@@H@Z.QT5CORE(?,00000000,?,?,?,?,00000000,00000010,00000000,?,00000000), ref: 6A66E691
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A66E6BD
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE ref: 6A66E70B
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?,?,?,?,00000000,00000010,00000000,?,00000000), ref: 6A66E720
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@List$String@@$?dispose@Data@1@@Thread$??8@?append@Array@@BytePool@@String@@0@V0@@$?detach@?max?prepend@?start@Count@Data@1@Runnable@@memmove
                                          • String ID:
                                          • API String ID: 2774143788-0
                                          • Opcode ID: 44e1b6897a80526ce1e7a363ab64af7a5dadbcc1be019bfbbbcc6a96fd7453f7
                                          • Instruction ID: b0c2147f8dc2c4a33723a9aae9bbf83cb3e02881632b672dbf601336f387ffde
                                          • Opcode Fuzzy Hash: 44e1b6897a80526ce1e7a363ab64af7a5dadbcc1be019bfbbbcc6a96fd7453f7
                                          • Instruction Fuzzy Hash: 38025B75604202CFDB00CF58C88495AB7F1FF89318B1A1669E956AB352DB31FD56CF82
                                          Function 6A67E070 Relevance: 27.2, APIs: 18, Instructions: 201networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?hostName@QNetworkProxy@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A67E0E0
                                            • Part of subcall function 6A672F80: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,?,6A67E0E5,?), ref: 6A672F94
                                            • Part of subcall function 6A672F80: ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000,?,?,?,6A67E0E5,?), ref: 6A672F9D
                                            • Part of subcall function 6A672F80: ??1QString@@QAE@XZ.QT5CORE(?,?,?,6A67E0E5,?), ref: 6A672FA7
                                          • ?hostName@QNetworkProxy@@QBE?AVQString@@XZ.QT5NETWORK(?,?), ref: 6A67E0F1
                                            • Part of subcall function 6A672F80: ??0QString@@QAE@XZ.QT5CORE(?,?,6A67E0E5,?), ref: 6A672FB8
                                            • Part of subcall function 6A672F80: ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000,?,6A67E0E5,?), ref: 6A672FC1
                                            • Part of subcall function 6A672F80: ??1QString@@QAE@XZ.QT5CORE(?,6A67E0E5,?), ref: 6A672FCB
                                          • ??8@YA_NABVQString@@0@Z.QT5CORE(00000000,00000000,?,?), ref: 6A67E0F8
                                          • ?port@QNetworkProxy@@QBEGXZ.QT5NETWORK(?,6BB6C190,?,?,?,?,?,?,00000000,6BB6C190,?), ref: 6A67E11C
                                          • ?port@QNetworkProxy@@QBEGXZ.QT5NETWORK(?,6BB6C190,?,?,?,?,?,?,00000000,6BB6C190,?), ref: 6A67E126
                                          • ??1QString@@QAE@XZ.QT5CORE(?,6BB6C190,?,?,?,?,?,?,00000000,6BB6C190,?), ref: 6A67E138
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,00000000,6BB6C190,?), ref: 6A67E142
                                          • ?type@QNetworkProxy@@QBE?AW4ProxyType@1@XZ.QT5NETWORK ref: 6A67E158
                                          • ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(00000000), ref: 6A67E195
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A67E1CA
                                          • ??1QNetworkProxy@@QAE@XZ.QT5NETWORK ref: 6A67E215
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000), ref: 6A67E223
                                          • ??4QNetworkProxy@@QAEAAV0@ABV0@@Z.QT5NETWORK(?), ref: 6A67E246
                                          • ??1QString@@QAE@XZ.QT5CORE(?,6BB6C190,?,?,?,?,?,?,00000000,6BB6C190,?), ref: 6A67E255
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,00000000,6BB6C190,?), ref: 6A67E25F
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,7FFFFFFF,00000001), ref: 6A67E2AC
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A67E2B8
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?), ref: 6A67E2C1
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$NetworkProxy@@V0@@$Array@@Authenticator@@ByteData@@ListShared$?host?port@E@$$Name@$??8@?append@?detach@?dispose@?type@Data@1@Data@1@@ProxyString@@0@Type@1@
                                          • String ID:
                                          • API String ID: 2239218307-0
                                          • Opcode ID: 6e7fc9e77861a1c4dc6ad327207457873a1e8c9e61a625854eb1e2362be69a7e
                                          • Instruction ID: e7952c3e13d1f7fd6d72af681a58a9425e357ff802f2bc67f467d63fede82d09
                                          • Opcode Fuzzy Hash: 6e7fc9e77861a1c4dc6ad327207457873a1e8c9e61a625854eb1e2362be69a7e
                                          • Instruction Fuzzy Hash: AC71CC746143058FD710DF68C8C095AB7E1FF86318F65096CE56A8B3A2DB32ED4ACB46
                                          Function 6A6868C0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(00000012,SOCKS5 proxy error), ref: 6A6868E2
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(00000014,Control socket error), ref: 6A6868F6
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A68690E
                                          • ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(?,00000000,00000000,00000000), ref: 6A68692A
                                          • ?setParent@QObject@@QAEXPAV1@@Z.QT5CORE(00000000), ref: 6A68693A
                                          • ??4QHostAddress@@QAEAAV0@ABV0@@Z.QT5NETWORK(?), ref: 6A68694D
                                          • ?lock@QMutex@@QAEXXZ.QT5CORE(?), ref: 6A686988
                                          • ?start@QElapsedTimer@@QAEXXZ.QT5CORE(?), ref: 6A686996
                                          • ?rehash@QHashData@@QAEXH@Z.QT5CORE(?,?,?), ref: 6A6869DA
                                          • ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000004,?,?), ref: 6A6869FC
                                          • ?startTimer@QObject@@QAEHHW4TimerType@Qt@@@Z.QT5CORE(0000EA60,00000001,?,?), ref: 6A686A3F
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE(?,?), ref: 6A686A4C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@String@@$Data@@HashLatin1String@@@$?allocate?disconnect@?lock@?rehash@?set?start?start@?unlock@Address@@D01@ElapsedHostLocker@@MutexMutex@@Node@Parent@Qt@@@TimerTimer@Timer@@Type@V0@@V1@@
                                          • String ID: (/pj$Control socket error$SOCKS5 proxy error
                                          • API String ID: 3512787242-4187120010
                                          • Opcode ID: 9d140c5baa937e61532943e4927b4450bc486992839d4a08bdd7e99f5061ae71
                                          • Instruction ID: 676521326e8066c892019dfc9fe1d03ddc5ce079bfb10e45a8a5c077dcd0010b
                                          • Opcode Fuzzy Hash: 9d140c5baa937e61532943e4927b4450bc486992839d4a08bdd7e99f5061ae71
                                          • Instruction Fuzzy Hash: 4D5157B42047029FD704CF69C894A6ABBF4FF49314F01892DE6AA8B391DB34E845CF91
                                          Function 6A614330 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 110networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?configuration@QNetworkSession@@QBE?AVQNetworkConfiguration@@XZ.QT5NETWORK(?,?,?,6BB1E2C0,?,00000000,?,?,0000000C,?), ref: 6A614386
                                          • ??1QNetworkConfiguration@@QAE@XZ.QT5NETWORK(?,?,?,6BB1E2C0,?,00000000,?,?,0000000C,?), ref: 6A614399
                                          • ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(?,2opened(),?,2networkSessionConnected(),?,?,?,6BB1E2C0,?,00000000,?,?,0000000C,?), ref: 6A6143B3
                                          • ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(?,2closed(),?,1_q_networkSessionClosed(),?,00000000,?,?,0000000C,?), ref: 6A6143C7
                                          • ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(?,2stateChanged(QNetworkSession::State),?,1_q_networkSessionStateChanged(QNetworkSession::State),?,00000000,?,?,0000000C,?), ref: 6A6143DB
                                          • ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(?,2error(QNetworkSession::SessionError),?,1_q_networkSessionFailed(QNetworkSession::SessionError),?,00000000,?,?,0000000C,?), ref: 6A6143EF
                                          Strings
                                          • 1_q_networkSessionStateChanged(QNetworkSession::State), xrefs: 6A6143C9
                                          • 2stateChanged(QNetworkSession::State), xrefs: 6A6143D2
                                          • 1_q_networkSessionFailed(QNetworkSession::SessionError), xrefs: 6A6143DD
                                          • 2networkSessionConnected(), xrefs: 6A61439E
                                          • 1_q_networkSessionClosed(), xrefs: 6A6143B5
                                          • 2opened(), xrefs: 6A6143A7
                                          • 2closed(), xrefs: 6A6143BE
                                          • 2error(QNetworkSession::SessionError), xrefs: 6A6143E6
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?disconnect@D01@Object@@$Network$Configuration@@$?configuration@Session@@
                                          • String ID: 1_q_networkSessionClosed()$1_q_networkSessionFailed(QNetworkSession::SessionError)$1_q_networkSessionStateChanged(QNetworkSession::State)$2closed()$2error(QNetworkSession::SessionError)$2networkSessionConnected()$2opened()$2stateChanged(QNetworkSession::State)
                                          • API String ID: 3621597432-3007809043
                                          • Opcode ID: 63c025a1ee64f068f5dc638c448fe377e2de357cc1c3760cca4749799651ac55
                                          • Instruction ID: 5e220b634b6752c135e9d25e91efc1de0ec640a56754497130b976f7f8fdb66b
                                          • Opcode Fuzzy Hash: 63c025a1ee64f068f5dc638c448fe377e2de357cc1c3760cca4749799651ac55
                                          • Instruction Fuzzy Hash: EE41BFB1509301ABCB019F58CC84A5BBFB0EF84724F010569EA5A5B252EF71FC19CBD2
                                          Function 6A67A2D0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 109windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QObjectPrivate@@QAE@H@Z.QT5CORE(00050F02,?,?,?,?,?,?,6A612D53), ref: 6A67A2EC
                                          • CoInitialize.OLE32 ref: 6A67A30E
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6A67A325
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,00000000,?,?,?,?,?,6A612D53), ref: 6A67A35F
                                          • ?warning@QMessageLogger@@QBE?AVQDebug@@XZ.QT5CORE(?,?,00000000,?,?,?,?,?,6A612D53), ref: 6A67A36C
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE(Failed to initialize COM:,?,00000000,?,?,?,?,?,6A612D53), ref: 6A67A379
                                          • ??6QDebug@@QAEAAV0@ABVQString@@@Z.QT5CORE(00000000,?,?,?,00000000,?,?,?,?,?,6A612D53), ref: 6A67A392
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,00000000,?,?,?,?,?,6A612D53), ref: 6A67A39C
                                          • ??1QDebug@@QAE@XZ.QT5CORE(?,?,?,00000000,?,?,?,?,?,6A612D53), ref: 6A67A3A6
                                          • ??0QObject@@IAE@AAVQObjectPrivate@@PAV0@@Z.QT5CORE(00000000,?,00000000,?,00000000,?,?,?,?,?,6A612D53), ref: 6A67A3EE
                                          • ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.monitor,?,00000000,?,?,?,?,?,6A612D53), ref: 6A67A42A
                                          • __Init_thread_footer.LIBCMT ref: 6A67A43F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Debug@@$Category@@Logger@@LoggingMessageObjectPrivate@@$?warning@Enabled@H00@Init_thread_footerInitializeObject@@String@@String@@@V0@@Warningmalloc
                                          • String ID: Failed to initialize COM:$qt.network.monitor
                                          • API String ID: 3760539278-1256046965
                                          • Opcode ID: eb15a7a778d53f3d75c2e49bac1a9b5e5420cd3f78fd326936594f4efa8ade8f
                                          • Instruction ID: 15a1de0b01632544a9c021a3b1afe0a7ed66101adc97c3f168858a7d122c48fb
                                          • Opcode Fuzzy Hash: eb15a7a778d53f3d75c2e49bac1a9b5e5420cd3f78fd326936594f4efa8ade8f
                                          • Instruction Fuzzy Hash: E941AFB1610201ABDB149F60C95CB6A7BF5FB56719F020068FA07C7681EF35EC15CBA2
                                          Function 6A6AC0B0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 88windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?), ref: 6A6AC0CC
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6AC104
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6AC0E8
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocketBackendPrivate::text_from_X509: null X509), ref: 6A6AC0F4
                                            • Part of subcall function 6A6A5150: ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,6A6AC16A,00000000,?), ref: 6A6A5163
                                            • Part of subcall function 6A6A5150: ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,6A6AC16A,00000000,?), ref: 6A6A517E
                                            • Part of subcall function 6A6A5150: ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,X509_print,?,?,6A6AC16A,00000000,?), ref: 6A6A518F
                                            • Part of subcall function 6A6A0390: ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,?,00000000,?), ref: 6A6A03A3
                                            • Part of subcall function 6A6A0390: ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,?,00000000,?), ref: 6A6A03BE
                                            • Part of subcall function 6A6A0390: ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,BIO_read,?,?,?,00000000,?), ref: 6A6A03CF
                                          • ??0QString@@QAE@XZ.QT5CORE(?), ref: 6A6AC11D
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6AC13E
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6AC148
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(?,00000000,?,?,?,00000000,?), ref: 6A6AC19E
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000,?,?,?,00000000,?), ref: 6A6AC1A9
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,00000000,?), ref: 6A6AC1B3
                                          • ?fromLatin1@QString@@SA?AV1@ABVQByteArray@@@Z.QT5CORE(?,?,00000000,?,?,?,00000000,?), ref: 6A6AC1CC
                                          • free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00000000,?), ref: 6A6AC1E2
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,00000000,?), ref: 6A6AC1EF
                                          Strings
                                          • QSslSocketBackendPrivate::text_from_X509: null X509, xrefs: 6A6AC0EE
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$Byte$Array@@Category@@LoggingString@@$?warning@Enabled@H00@Warning$?fromArray@@@DateInit_thread_footerLatin1@Time@@V0@$$V0@@free
                                          • String ID: QSslSocketBackendPrivate::text_from_X509: null X509
                                          • API String ID: 518799912-1253541696
                                          • Opcode ID: 2a1041614dd45b932e17f7b9b5316157a2a031d93f437ff1b8255b8c529c35b3
                                          • Instruction ID: 8ccdceda2df2b7f996cc2b190e4581e426e064ea634a413d75c40c10eede60c7
                                          • Opcode Fuzzy Hash: 2a1041614dd45b932e17f7b9b5316157a2a031d93f437ff1b8255b8c529c35b3
                                          • Instruction Fuzzy Hash: 393162B11052019BDB10AFA4CD48B9E7BF8AF45345F424818F75BD6290DF74AE04CB9A
                                          Function 6A61AB60 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 87COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?className@QMetaObject@@QBEPBDXZ.QT5CORE(?,00007530,00007530,?), ref: 6A61AB77
                                          • ??0QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A6814CC), ref: 6A61AB83
                                          • ?reserve@QByteArray@@QAEXH@Z.QT5CORE(-00000010,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A6814CC), ref: 6A61ABA1
                                          • ?append@QByteArray@@QAEAAV1@PBDH@Z.QT5CORE(QSharedPointer,0000000E), ref: 6A61ABB2
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(0000003C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A6814CC), ref: 6A61ABC2
                                          • ?append@QByteArray@@QAEAAV1@PBD@Z.QT5CORE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A6814CC), ref: 6A61ABC7
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(0000003E,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A6814CC), ref: 6A61ABD1
                                          • ?registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAX1PBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z.QT5CORE(?,6A613F80), ref: 6A61ABF3
                                          • ?hasRegisteredConverterFunction@QMetaType@@SA_NHH@Z.QT5CORE(00000000,00000027,?,?,?,?,?,00000008,00000127,00000000), ref: 6A61AC05
                                          • ?registerConverterFunction@QMetaType@@SA_NPBUAbstractConverterFunction@QtPrivate@@HH@Z.QT5CORE(6A702514,00000000,00000027,?,?,?,?,?,?,?,?,00000008,00000127,00000000), ref: 6A61AC36
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,00000008,00000127,00000000), ref: 6A61AC49
                                          • __Init_thread_footer.LIBCMT ref: 6A61AC86
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$Meta$?append@$ConverterFunction@Type@@$?register$?class?has?reserve@AbstractFlag@Flags@Init_thread_footerName@NormalizedObject@@Object@@@Private@@RegisteredString@@TypeType@Type@@@@
                                          • String ID: '$QSharedPointer
                                          • API String ID: 2350130831-1706557631
                                          • Opcode ID: 1ade353df0086dbca8b9e5593616fd8e5c3e3bb3603b9301918e4808206acf6b
                                          • Instruction ID: 8df42b4c1957c8daf806e103a25d2fda9fe3adae502e1f04257b2d864c89cd91
                                          • Opcode Fuzzy Hash: 1ade353df0086dbca8b9e5593616fd8e5c3e3bb3603b9301918e4808206acf6b
                                          • Instruction Fuzzy Hash: 7B31E4B56442019BCF049F69CD58E593BB0EB56351F0104B8EA87D7380DF359D0ACBD6
                                          Function 6A616A00 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 108COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPAU12@PBVQObject@@@Z.QT5CORE(?,?,?,6A6150E4,00000000), ref: 6A616A1E
                                          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PBV1@PAPAX01PAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PBHPBU3@@Z.QT5CORE(?,?,?,?,00000000,00000000,00000000,00000000,?), ref: 6A616A9B
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A616AAA
                                          • ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PBV1@PAPAX01PAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PBHPBU3@@Z.QT5CORE(?,?,?,?,00000000,00000000,00000000,00000000,?), ref: 6A616AEE
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A616AF7
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2sslErrors(QList<QSslError>),?,1_q_replySslErrors(QList<QSslError>),00000000), ref: 6A616B19
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A616B22
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2preSharedKeyAuthenticationRequired(QSslPreSharedKeyAuthenticator*),?,1_q_replyPreSharedKeyAuthenticationRequired(QSslPreSharedKeyAuthenticator*),00000000), ref: 6A616B3D
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A616B46
                                          Strings
                                          • 1_q_replyPreSharedKeyAuthenticationRequired(QSslPreSharedKeyAuthenticator*), xrefs: 6A616B26
                                          • 2preSharedKeyAuthenticationRequired(QSslPreSharedKeyAuthenticator*), xrefs: 6A616B33
                                          • 2sslErrors(QList<QSslError>), xrefs: 6A616B0E
                                          • 1_q_replySslErrors(QList<QSslError>), xrefs: 6A616B05
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$Connection@Meta$ConnectionType@$?connect?connect@Base@Impl@ObjectPrivate@@Qt@@Qt@@@SlotU3@@$?getCountData@ExternalObject@@@Pointer@@Ref@SharedU12@
                                          • String ID: 1_q_replyPreSharedKeyAuthenticationRequired(QSslPreSharedKeyAuthenticator*)$1_q_replySslErrors(QList<QSslError>)$2preSharedKeyAuthenticationRequired(QSslPreSharedKeyAuthenticator*)$2sslErrors(QList<QSslError>)
                                          • API String ID: 2525764155-3276072006
                                          • Opcode ID: fd99720081bddc205f98f8cd8c0827dd9ea591943e99e10a96801d7224082590
                                          • Instruction ID: bd172ebe3d0781931fabfc047fce0eeab5dc9fc1ccdea62828e757f801fd14da
                                          • Opcode Fuzzy Hash: fd99720081bddc205f98f8cd8c0827dd9ea591943e99e10a96801d7224082590
                                          • Instruction Fuzzy Hash: 914137B5504300AFD700DF58CC41F9BBBE8AF84314F05895DF6999B291EB70E905CBA2
                                          Function 6A61C070 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 77COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QVariant@@QAE@_N@Z.QT5CORE(00000001), ref: 6A61C093
                                            • Part of subcall function 6A61AE00: ?isValid@QVariant@@QBE_NXZ.QT5CORE ref: 6A61AE0C
                                            • Part of subcall function 6A61AE00: ?rehash@QHashData@@QAEXH@Z.QT5CORE(?,?,?), ref: 6A61AE5A
                                            • Part of subcall function 6A61AE00: ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000008,?,?), ref: 6A61AE77
                                            • Part of subcall function 6A61AE00: ??0QVariant@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A61AE95
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A61C0AB
                                          • ?translate@QCoreApplication@@SA?AVQString@@PBD00H@Z.QT5CORE(?,QNetworkAccessCacheBackend,Error opening %1,00000000,000000FF), ref: 6A61C0D1
                                          • ?toString@QUrl@@QBE?AVQString@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z.QT5CORE(?,00000000,?), ref: 6A61C0F1
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(00000020), ref: 6A61C105
                                          • ?arg@QString@@QBE?AV1@ABV1@HVQChar@@@Z.QT5CORE(?,00000000,00000000), ref: 6A61C115
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61C11F
                                          • ??1QUrl@@QAE@XZ.QT5CORE ref: 6A61C129
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61C133
                                          • ??1QString@@QAE@XZ.QT5CORE(000000CB,?), ref: 6A61C14E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Variant@@$Url@@$Char@@@Data@@FormattingHash$?allocate?arg@?rehash@?translate@Application@@Char@@ComponentCoreFlags@Latin1Node@Option@Option@2@@@@String@V0@@Valid@
                                          • String ID: $Error opening %1$QNetworkAccessCacheBackend
                                          • API String ID: 3703959417-2178054411
                                          • Opcode ID: 912ea06797252361a63df631527610d5af64fb2fa195bb716a1ffe0bfb75d1af
                                          • Instruction ID: f435d931a8f208973869aba220df7ccdbbbc04f175c3328cee6bbf6fae14e928
                                          • Opcode Fuzzy Hash: 912ea06797252361a63df631527610d5af64fb2fa195bb716a1ffe0bfb75d1af
                                          • Instruction Fuzzy Hash: F921A1B02083055BDB04EB65C998E9E7BF8EB95229F01052DF947D2291DE34AD0DC762
                                          Function 6A66A090 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 47COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QDebugStateSaver@@QAE@AAVQDebug@@@Z.QT5CORE(?), ref: 6A66A09E
                                          • ?resetFormat@QDebug@@QAEAAV1@XZ.QT5CORE ref: 6A66A0A8
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE(QHostAddress(QHostAddress::Any)), ref: 6A66A0C9
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE(QHostAddress(), ref: 6A66A0D6
                                          • ?toString@QHostAddress@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A66A0E5
                                          • ??6QDebug@@QAEAAV0@ABVQString@@@Z.QT5CORE(00000000,?), ref: 6A66A0ED
                                          • ??6QDebug@@QAEAAV0@D@Z.QT5CORE(00000029), ref: 6A66A0F7
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A66A101
                                          • ??0QDebug@@QAE@$$QAV0@@Z.QT5CORE(?), ref: 6A66A110
                                          • ??1QDebugStateSaver@@QAE@XZ.QT5CORE ref: 6A66A11A
                                          • ??1QDebug@@QAE@XZ.QT5CORE ref: 6A66A124
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Debug@@$DebugSaver@@StateString@@$?resetAddress@@Debug@@@E@$$Format@HostString@String@@@V0@@
                                          • String ID: QHostAddress($QHostAddress(QHostAddress::Any)
                                          • API String ID: 3227118075-3248975437
                                          • Opcode ID: ca732bb4b1e8c4f0e69d5230cb37ea70c0137ea995f67f0466bcf065ffd90e25
                                          • Instruction ID: 97b6b90a6e295e78ce81d3b8b51cc646e6a671aad91e053938417cbeae5fddd2
                                          • Opcode Fuzzy Hash: ca732bb4b1e8c4f0e69d5230cb37ea70c0137ea995f67f0466bcf065ffd90e25
                                          • Instruction Fuzzy Hash: 5B1118B4508247DFCB04DF65D45C99A7BF8EBA534AF014818F447D3291EB30AD0ACBA2
                                          Function 6A6AC2B0 Relevance: 22.7, APIs: 15, Instructions: 220COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(00000000,00000011,?,?,?,?,?,6A6AB8E9,?), ref: 6A6AC2FC
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000011,?,?,?,?,6A6AB8E9,?), ref: 6A6AC323
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,6A6AB8E9,?), ref: 6A6AC375
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,?,?,?,?,6A6AB8E9,?), ref: 6A6AC380
                                          • ?realloc@QListData@@QAEXH@Z.QT5CORE(00000000,00000011,?,?,?,?,?,6A6AB8E9,?), ref: 6A6AC38E
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(?,00000001), ref: 6A6AC3FE
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000000), ref: 6A6AC427
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000000), ref: 6A6AC463
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6AC4A7
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000), ref: 6A6AC4B2
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,?,?,?,?,6A6AB8E9,?), ref: 6A6AC4D4
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,00000011,?,?,?,?,?,6A6AB8E9,?), ref: 6A6AC4E7
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?,?,?,?,6A6AB8E9,?), ref: 6A6AC4EF
                                          • ?nextNode@QMapNodeBase@@QBEPBU1@XZ.QT5CORE(?,?,?,?,6A6AB8E9,?), ref: 6A6AC503
                                          • ?qstrcmp@@YAHABVQByteArray@@0@Z.QT5CORE(?,0000000C,?,?,?,?,6A6AB8E9,?), ref: 6A6AC521
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$Array@@$Data@@List$V0@@$?dispose@Data@1@Data@1@@$?append@?detach@?detach_grow@?next?qstrcmp@@?realloc@Array@@0@Base@@NodeNode@
                                          • String ID:
                                          • API String ID: 118449134-0
                                          • Opcode ID: a0f8be95f7c0d60766adf7803d26be7e81115986d6986ed6a17df32fd13e23e5
                                          • Instruction ID: e1ff590aa149842c6c947da3cdae65d11f7ab9b9d10fe4468fcec1d4d63625b8
                                          • Opcode Fuzzy Hash: a0f8be95f7c0d60766adf7803d26be7e81115986d6986ed6a17df32fd13e23e5
                                          • Instruction Fuzzy Hash: 6B816F72A042158FCB10DF58C88055AB3F1FF85328B164568ED6BAB392DB31FD4ACB95
                                          Function 6A644300 Relevance: 22.6, APIs: 15, Instructions: 87COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMutex@@QAE@XZ.QT5CORE(00000004,00000000,6BBE0EA0,00000000,6A643AD6,?,00000000,?), ref: 6A64430A
                                          • ?scheme@QUrl@@QBE?AVQString@@XZ.QT5CORE(?), ref: 6A644327
                                          • ?setScheme@QUrl@@QAEXABVQString@@@Z.QT5CORE(00000000), ref: 6A644330
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A64433A
                                          • ??1QUrl@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A64434A
                                          • ?authority@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?,01F00006,00000000), ref: 6A644366
                                          • ?setAuthority@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z.QT5CORE(00000000), ref: 6A64436F
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A644379
                                          • ??1QUrl@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A644383
                                            • Part of subcall function 6A652330: ??0QUrl@@QAE@ABV0@@Z.QT5CORE(?,?,?,?,6A65DBEA,?,?,?), ref: 6A652363
                                            • Part of subcall function 6A652330: ?path@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A65237B
                                            • Part of subcall function 6A652330: ??1QString@@QAE@XZ.QT5CORE ref: 6A65238A
                                            • Part of subcall function 6A652330: ?setPath@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z.QT5CORE(?), ref: 6A6523A7
                                            • Part of subcall function 6A652330: ??1QString@@QAE@XZ.QT5CORE ref: 6A6523B1
                                            • Part of subcall function 6A652330: ?toEncoded@QUrl@@QBE?AVQByteArray@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z.QT5CORE(?,01F00086), ref: 6A6523C9
                                            • Part of subcall function 6A652330: ??1QUrl@@QAE@XZ.QT5CORE ref: 6A6523D3
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,00000000), ref: 6A64439D
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A6443C0
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(00000000,00000000), ref: 6A6443CC
                                          • ?setPath@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z.QT5CORE(?,00000002), ref: 6A6443DB
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A6443E5
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A6443EF
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Url@@$?setFormatting$ComponentFlags@Mode@1@@Option@Parsing$?data@Array@@ByteChar@@Path@String@@@Url@@@@@$?authority@?path@?scheme@Authority@Encoded@Latin1Mutex@@Option@2@@@@Scheme@V0@@
                                          • String ID:
                                          • API String ID: 2929246883-0
                                          • Opcode ID: 842dad66b504489fe22e58fae1cbcf2f439d8405d718ec2cb9e324a99c3f941e
                                          • Instruction ID: 7efe2f55d2dd9f1b34b7fcdf4517d741f5c97f5a1bb7b5fad4649c02738c13f5
                                          • Opcode Fuzzy Hash: 842dad66b504489fe22e58fae1cbcf2f439d8405d718ec2cb9e324a99c3f941e
                                          • Instruction Fuzzy Hash: 37310CB12042169FCB04DF65D858A6EBBF9EF99645F02442CF54BC7291DF30AD09CB91
                                          Function 6A6B8150 Relevance: 21.2, APIs: 14, Instructions: 212COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7af3952e724abb0225c24a248546fcc485dd03fd32494f32779ee916d1e60642
                                          • Instruction ID: fe5e88ac5dd32243d89b08fac12a51c69747ef0b934ae602ad379934a45c3138
                                          • Opcode Fuzzy Hash: 7af3952e724abb0225c24a248546fcc485dd03fd32494f32779ee916d1e60642
                                          • Instruction Fuzzy Hash: 2D81BD725042029FC704DF58C89095AF7F0FF84318F46496DE8AA973A2EB30ED59CB86
                                          Function 6A67C120 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 90windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,00000000), ref: 6A67C153
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,00000000), ref: 6A67C191
                                          • ?warning@QMessageLogger@@QBE?AVQDebug@@XZ.QT5CORE(?), ref: 6A67C19E
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE(Failed to unsubscribe from network connection events:), ref: 6A67C1AB
                                          • ??6QDebug@@QAEAAV0@ABVQString@@@Z.QT5CORE(00000000), ref: 6A67C1C4
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A67C1CE
                                          • ??1QDebug@@QAE@XZ.QT5CORE ref: 6A67C1D8
                                          • ??0QUuid@@QAE@XZ.QT5CORE(?,00000000), ref: 6A67C1FB
                                          • ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.monitor,00000000), ref: 6A67C242
                                          • __Init_thread_footer.LIBCMT ref: 6A67C257
                                          Strings
                                          • qt.network.monitor, xrefs: 6A67C238
                                          • Failed to unsubscribe from network connection events:, xrefs: 6A67C1A4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Debug@@$Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerString@@String@@@Uuid@@Warning
                                          • String ID: Failed to unsubscribe from network connection events:$qt.network.monitor
                                          • API String ID: 4076611594-698952763
                                          • Opcode ID: b6a39c49e805261a88f653d0f9535cff6a96075d245a6b318115f62fb9744eca
                                          • Instruction ID: 7db923ae7d8e98efce9f9948e5ce4c692ec045a97b594df5f1987763084968e8
                                          • Opcode Fuzzy Hash: b6a39c49e805261a88f653d0f9535cff6a96075d245a6b318115f62fb9744eca
                                          • Instruction Fuzzy Hash: 6731CEB26042019FDF149F64C958A6AB7F5FB9A219F02456DE60BC3291EF30FD05CB92
                                          Function 6A6B2288 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 89windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?lock@QMutex@@QAEXXZ.QT5CORE ref: 6A6B22A3
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6B22E0
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6B22FD
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: OpenSSL >= 1.1.1 is required; %s was found instead,00000000,00000000), ref: 6A6B2313
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE ref: 6A6B2320
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A6B236E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,Random number generator not seeded, disabling SSL support), ref: 6A6B237A
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE ref: 6A6B2386
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE ref: 6A6B239C
                                          Strings
                                          • Random number generator not seeded, disabling SSL support, xrefs: 6A6B2374
                                          • w4pj, xrefs: 6A6B2290
                                          • QSslSocket: OpenSSL >= 1.1.1 is required; %s was found instead, xrefs: 6A6B230D
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?unlock@Locker@@Mutex$?warning@$?lock@Category@@Enabled@H00@LoggingMutex@@Warning
                                          • String ID: QSslSocket: OpenSSL >= 1.1.1 is required; %s was found instead$Random number generator not seeded, disabling SSL support$w4pj
                                          • API String ID: 2759277714-1937433933
                                          • Opcode ID: a703ddcaf26872b680de2f6e5546de271a82d8201d15e4986145f2a7d3c7a750
                                          • Instruction ID: 5a9a36cd808fab26de29c9e0ee022d8a1789838b9afd96aa1078071c6944f035
                                          • Opcode Fuzzy Hash: a703ddcaf26872b680de2f6e5546de271a82d8201d15e4986145f2a7d3c7a750
                                          • Instruction Fuzzy Hash: BC21D6F4544200ABEF006BB18C0EF697BF4AF02705F420458F687DA1D2EF75AD54876A
                                          Function 6A692920 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 77timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32(?,00000000), ref: 6A69293C
                                          • ?fromLatin1@QString@@SA?AV1@PBDH@Z.QT5CORE(?,%1: %2,000000FF), ref: 6A692950
                                          • ?qt_error_string@@YA?AVQString@@H@Z.QT5CORE(?,00000000), ref: 6A692960
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A69297A
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A69298B
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A6929A7
                                          • ?argToQString@QtPrivate@@YA?AVQString@@VQStringView@@IPAPBUArgBase@1@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6A6929E6
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(?), ref: 6A6929FB
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A692A05
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A692A0F
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A692A19
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$?data@Char@@$?arg?from?qt_error_string@@Base@1@@DateErrorLastLatin1@Private@@StringString@Time@@V0@$$V0@@View@@
                                          • String ID: %1: %2
                                          • API String ID: 2328031735-4246567762
                                          • Opcode ID: 9704cdacd39f58e118b4b8eb35675059aeb86645f75909de680ff3d3f22234af
                                          • Instruction ID: 52bd5670a9f424ebceda257880c8c9af9ba3f6335d52e509d08f9ddce25d3346
                                          • Opcode Fuzzy Hash: 9704cdacd39f58e118b4b8eb35675059aeb86645f75909de680ff3d3f22234af
                                          • Instruction Fuzzy Hash: 4B31C2B55083419FCB00DF29C44895ABBF4BF8A354F454A2EF59AD3361EB75E904CB82
                                          Function 6A640AB0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 74windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(00000000,00000000,?,00000000,?,?,?,?,?,6A63FD9E,?,?,?), ref: 6A640AE1
                                          • ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 6A640AFE
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,?,?,?,6A63FD9E,?,?,?), ref: 6A640B1A
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,6A63FD9E,?,?,?), ref: 6A640B36
                                          • ?warning@QMessageLogger@@QBE?AVQDebug@@XZ.QT5CORE(?,?,6A63FD9E,?,?,?), ref: 6A640B43
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE(stream,?,6A63FD9E,?,?,?), ref: 6A640B50
                                          • ??6QDebug@@QAEAAV0@I@Z.QT5CORE(?,?,6A63FD9E,?,?,?), ref: 6A640B5B
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE(finished with error:,?,6A63FD9E,?,?,?), ref: 6A640B68
                                          • ??6QDebug@@QAEAAV0@ABVQString@@@Z.QT5CORE(?,?,6A63FD9E,?,?,?), ref: 6A640B71
                                          • ??1QDebug@@QAE@XZ.QT5CORE(?,6A63FD9E,?,?,?), ref: 6A640B7B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Debug@@$?disconnect@D01@Logger@@MessageObject@@$?warning@Category@@Enabled@H00@LoggingString@@@Warning
                                          • String ID: finished with error:$stream
                                          • API String ID: 3706650963-955335027
                                          • Opcode ID: 26ba8864e96381b6bc82766f6839990ca28a8bf73ce91fda79521b4e8fa6db97
                                          • Instruction ID: 4ed17367532af336f9e8712ab8dff4cfe6a8d2d906cd46131c06414f1188c803
                                          • Opcode Fuzzy Hash: 26ba8864e96381b6bc82766f6839990ca28a8bf73ce91fda79521b4e8fa6db97
                                          • Instruction Fuzzy Hash: B1218BB5610314ABDF056BA58C1CB7E77F9EB85608F420818FA0397281EF65AD058BA9
                                          Function 6A680820 Relevance: 19.7, APIs: 13, Instructions: 169networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QHostAddress@@QAE@XZ.QT5NETWORK ref: 6A68084D
                                          • ?toString@QHostAddress@@QBE?AVQString@@XZ.QT5NETWORK(?,?), ref: 6A68085C
                                          • ??1QString@@QAE@XZ.QT5CORE(00000000,?,?), ref: 6A68086D
                                          • ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK ref: 6A680875
                                          • ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK ref: 6A680883
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK(00000000), ref: 6A680898
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK(00000000), ref: 6A6808A9
                                            • Part of subcall function 6A669E10: ??1QString@@QAE@XZ.QT5CORE(00000000,6A6ABD95,?), ref: 6A669E29
                                            • Part of subcall function 6A67F460: ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,6A681A64,?), ref: 6A67F46B
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(00000000,?), ref: 6A680943
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE ref: 6A68096A
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A680977
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK(?), ref: 6A6809B1
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(?,?,00000003,?,?), ref: 6A6809EF
                                          • ?isOpen@QIODevice@@QBE_NXZ.QT5CORE ref: 6A680A10
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Address@@Host$String@@$Object@@$?activate@?protocol@AbstractLayerMetaNetworkProtocol@Socket@@V0@@$Authenticator@@Device@@Open@SharedString@
                                          • String ID:
                                          • API String ID: 2344869069-0
                                          • Opcode ID: 57108de12385b60aa904db960f13d5819a2420101bef3ae96586066cd8d0fd38
                                          • Instruction ID: 728da2dc55b9bd7e7c9efeec51d1d9d7adc89244dd137296d43e1c9632b60833
                                          • Opcode Fuzzy Hash: 57108de12385b60aa904db960f13d5819a2420101bef3ae96586066cd8d0fd38
                                          • Instruction Fuzzy Hash: 0E5161B5245245DFDB20DF64C894FDA73E8FF85708F02446EE9499B291DF30AA09CB62
                                          Function 6A61C880 Relevance: 19.6, APIs: 13, Instructions: 79timeCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QSharedData@@QAE@ABV0@@Z.QT5CORE(00000001), ref: 6A61C8AB
                                          • ??0QDateTime@@QAE@ABV0@@Z.QT5CORE(00000005), ref: 6A61C8B8
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000009), ref: 6A61C8C5
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(0000000D), ref: 6A61C8D2
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000011), ref: 6A61C8DF
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000015), ref: 6A61C8EC
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000019), ref: 6A61C8F9
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A61C924
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A61C92D
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61C936
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61C93F
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61C948
                                          • ??1QDateTime@@QAE@XZ.QT5CORE ref: 6A61C951
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@ByteV0@@$String@@$DateTime@@$Data@@Sharedmalloc
                                          • String ID:
                                          • API String ID: 2332287437-0
                                          • Opcode ID: d1f72b052bdf6625ba7f924d675aeb22d0397ff7b009f22497215de4d6a5309f
                                          • Instruction ID: 890d4bd00c90493557667af1eaba7c1677cff36d07fe1048fb8d32282e0d3ef7
                                          • Opcode Fuzzy Hash: d1f72b052bdf6625ba7f924d675aeb22d0397ff7b009f22497215de4d6a5309f
                                          • Instruction Fuzzy Hash: 913169B1100A468FCB54CF25D898AAABBF8FF126153014569E49BC7191EF30FE4ACF90
                                          Function 6A682020 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 237timenetworkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?stateChanged@QAbstractSocket@@QAEXW4SocketState@1@@Z.QT5NETWORK(?), ref: 6A6820B7
                                          • ?error@QAbstractSocket@@QAEXW4SocketError@1@@Z.QT5NETWORK(?), ref: 6A6820CE
                                          • ?errorOccurred@QAbstractSocket@@QAEXW4SocketError@1@@Z.QT5NETWORK(?), ref: 6A6820E5
                                          • ?proxyAuthenticationRequired@QAbstractSocket@@QAEXABVQNetworkProxy@@PAVQAuthenticator@@@Z.QT5NETWORK(?,?), ref: 6A6820FF
                                          • ?stop@QTimer@@QAEXXZ.QT5CORE(?,?), ref: 6A682157
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?), ref: 6A68218C
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A6821A4
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6821AE
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(?,?,00000003,000000FF), ref: 6A6821E1
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(?,?,00000005,00000000), ref: 6A68220A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$AbstractSocket@@$MetaSocketString@@$?activate@Error@1@@$?error?error@?proxy?state?stop@?tr@AuthenticationAuthenticator@@@Changed@NetworkOccurred@Proxy@@Required@State@1@@Timer@@V0@@
                                          • String ID: Connection timed out
                                          • API String ID: 1777918917-1458536747
                                          • Opcode ID: 39528da109255b80591640b1f5f54bf386af25f2499336843a82a85c55851a64
                                          • Instruction ID: 40e02eb4ae4cc6f9095655faf96d53272595b27446cf5e3b3f42115b37abfb69
                                          • Opcode Fuzzy Hash: 39528da109255b80591640b1f5f54bf386af25f2499336843a82a85c55851a64
                                          • Instruction Fuzzy Hash: 4691A2B5504201DFC700DF68D894B8AB7F4FF85315F44499AE8A98B350DB36E949CFA2
                                          Function 6A68C300 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 108windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68C31C
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNativeSocketEngine::hasPendingDatagrams() was called on an uninitialized socket device), ref: 6A68C328
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68C348
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNativeSocketEngine::hasPendingDatagrams() was called in QAbstractSocket::UnconnectedState), ref: 6A68C354
                                          Strings
                                          • QNativeSocketEngine::hasPendingDatagrams() was called by a socket other than QAbstractSocket::UdpSocket, xrefs: 6A68C37A
                                          • QNativeSocketEngine::hasPendingDatagrams() was called on an uninitialized socket device, xrefs: 6A68C322
                                          • QNativeSocketEngine::hasPendingDatagrams() was called in QAbstractSocket::UnconnectedState, xrefs: 6A68C34E
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?warning@
                                          • String ID: QNativeSocketEngine::hasPendingDatagrams() was called by a socket other than QAbstractSocket::UdpSocket$QNativeSocketEngine::hasPendingDatagrams() was called in QAbstractSocket::UnconnectedState$QNativeSocketEngine::hasPendingDatagrams() was called on an uninitialized socket device
                                          • API String ID: 3543197520-1248737833
                                          • Opcode ID: 42f98fc274cc6be13d7ef57b00a7a1ba65ae58851c506b6ef4dc1cebf94ca2b8
                                          • Instruction ID: 617729d5abe94068c2ed3757226652ab9328c518cfc5299d1cee4bbba385917b
                                          • Opcode Fuzzy Hash: 42f98fc274cc6be13d7ef57b00a7a1ba65ae58851c506b6ef4dc1cebf94ca2b8
                                          • Instruction Fuzzy Hash: 3831D0B0544300ABDB10EB64CC4ABCB77F8BF46714F910A59FA4692190EB75E948CBA7
                                          Function 6A65C860 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 75timenetworkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QTimer@@QAE@PAVQObject@@@Z.QT5CORE(?,6A65B4E3,?,?,?,6A65B0B6,?,00000058,?,00000060), ref: 6A65C882
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,00000000,2timeout(),?,1_q_transferTimedOut(),00000002,?,?,?,6A65B0B6,?,00000058,?,00000060), ref: 6A65C8A7
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000060), ref: 6A65C8B4
                                          • ?stop@QTimer@@QAEXXZ.QT5CORE(?,?,?,?,6A65B4E3,?,?,?,6A65B0B6,?,00000058,?,00000060), ref: 6A65C8C0
                                          • ?transferTimeout@QNetworkRequest@@QBEHXZ.QT5NETWORK(?,?,?,6A65B0B6,?,00000058,?,00000060), ref: 6A65C8CC
                                          • ?transferTimeout@QNetworkRequest@@QBEHXZ.QT5NETWORK(?,?,?,6A65B0B6,?,00000058,?,00000060), ref: 6A65C8EB
                                          • ?setInterval@QTimer@@QAEXH@Z.QT5CORE(00000000,?,?,?,6A65B0B6,?,00000058,?,00000060), ref: 6A65C8F3
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(?,start,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6A65C932
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$MetaTimer@@$?transferConnectionConnection@GenericNetworkRequest@@Timeout@Type@$?connect@?invoke?set?stop@Argument@@Argument@@444444444@Interval@Method@Object@@@Qt@@Qt@@@Returnmalloc
                                          • String ID: 1_q_transferTimedOut()$2timeout()$start
                                          • API String ID: 1155908918-2919261196
                                          • Opcode ID: 121879cd7061f9cd198ac6dae9027bfd1ad0f01ee99041af4e87c305c24664f9
                                          • Instruction ID: 2f315bd974ff6716bf72f10f74857fdf14a68ee4400bcb017ac7452988918a69
                                          • Opcode Fuzzy Hash: 121879cd7061f9cd198ac6dae9027bfd1ad0f01ee99041af4e87c305c24664f9
                                          • Instruction Fuzzy Hash: CA115AB0200606ABEB588B25CC49F97BBB8FF45745F014228F61BD2181DF31BD21CB95
                                          Function 6A620070 Relevance: 18.1, APIs: 12, Instructions: 121COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QSharedData@@QAE@ABV0@@Z.QT5CORE ref: 6A620087
                                          • ??0QMutex@@QAE@XZ.QT5CORE(?), ref: 6A6200FB
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A620104
                                          • ??0QHttp2Configuration@@QAE@XZ.QT5NETWORK ref: 6A62010D
                                          • ??4QUrl@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A620119
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(00000000), ref: 6A620147
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A620156
                                          • ??4QHttp2Configuration@@QAEAAV0@ABV0@@Z.QT5NETWORK(?), ref: 6A620163
                                          • ??1QSslConfiguration@@QAE@XZ.QT5NETWORK(?), ref: 6A62018B
                                          • ??1QHttp2Configuration@@QAE@XZ.QT5NETWORK(?), ref: 6A62019E
                                          • ??1QString@@QAE@XZ.QT5CORE(?), ref: 6A6201A6
                                          • ??1QUrl@@QAE@XZ.QT5CORE ref: 6A6201AF
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: V0@@$Configuration@@$Http2String@@$SharedUrl@@$Authenticator@@Data@@Mutex@@malloc
                                          • String ID:
                                          • API String ID: 1848970821-0
                                          • Opcode ID: c6830001bfd880d8b75c630d0f9cb9becf5bd112a4e605642bffc6a8e66a5815
                                          • Instruction ID: fc4cb5efba01bef132bf4776612ddc690acad4823ad4ba16a3860ef3e3a78beb
                                          • Opcode Fuzzy Hash: c6830001bfd880d8b75c630d0f9cb9becf5bd112a4e605642bffc6a8e66a5815
                                          • Instruction Fuzzy Hash: 3641C3B110060A9FEB45CF64C894B9A7BB4FF45319B020229E91B87691EF30FD5ACF94
                                          Function 6A66C340 Relevance: 18.1, APIs: 12, Instructions: 119threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?lock@QMutex@@QAEXXZ.QT5CORE ref: 6A66C352
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE ref: 6A66C366
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE ref: 6A66C377
                                          • ??1QMutex@@QAE@XZ.QT5CORE ref: 6A66C37F
                                          • ??1QThreadPool@@UAE@XZ.QT5CORE ref: 6A66C388
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?), ref: 6A66C3B4
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?), ref: 6A66C3D7
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?), ref: 6A66C3FA
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?), ref: 6A66C41D
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?), ref: 6A66C440
                                          • ??1QMutex@@QAE@XZ.QT5CORE ref: 6A66C448
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(Function_00006160), ref: 6A66C47C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@$?dispose@Data@1@@List$Mutex@@$?unlock@Locker@@Mutex$?free_helper@?lock@HashNode@1@@Pool@@Thread
                                          • String ID:
                                          • API String ID: 3643465406-0
                                          • Opcode ID: d2ece6f36646663962a1a2fdf3b4200ceea092af3419e1fdfbb02fda72cc31eb
                                          • Instruction ID: 462cda17311a566366ad36873c5b7462e827c4f6198f80fb2d80a9eb4d43361e
                                          • Opcode Fuzzy Hash: d2ece6f36646663962a1a2fdf3b4200ceea092af3419e1fdfbb02fda72cc31eb
                                          • Instruction Fuzzy Hash: 46417D70201A018BEF618F79D84452A73B1BF4623432A561DE867D76E0DF35FC06CA52
                                          Function 6A646000 Relevance: 18.1, APIs: 12, Instructions: 104timenetworkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QObjectPrivate@@QAE@H@Z.QT5CORE(00050F02,?,?,?,?,6A645EDA,?,?,?,?), ref: 6A64600B
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE ref: 6A64602C
                                          • ??0QTimer@@QAE@PAVQObject@@@Z.QT5CORE(00000000), ref: 6A646072
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A64607C
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A646088
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A646094
                                          • ??0QNetworkProxy@@QAE@W4ProxyType@0@ABVQString@@G11@Z.QT5NETWORK(00000002,00000000,00000000,00000000,00000000), ref: 6A6460A4
                                          • ??1QString@@QAE@XZ.QT5CORE(00000002,00000000,00000000,00000000,00000000), ref: 6A6460AD
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6460B7
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6460C1
                                          • ??0QHttp2Configuration@@QAE@XZ.QT5NETWORK ref: 6A64610D
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A646118
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Array@@ByteConfiguration@@G11@Http2NetworkObjectObject@@@Private@@ProxyProxy@@Timer@@Type@0@V0@@
                                          • String ID:
                                          • API String ID: 1227833402-0
                                          • Opcode ID: 9003746be76d3b28b1d3f5117c0c02c3e93de6a3143f3a9a0c8c24eac1881a4a
                                          • Instruction ID: e108b3f94ade81443036122ffeedd6319fc95fa6c94fa8643424cff659ed02c7
                                          • Opcode Fuzzy Hash: 9003746be76d3b28b1d3f5117c0c02c3e93de6a3143f3a9a0c8c24eac1881a4a
                                          • Instruction Fuzzy Hash: D64142B52007058FDB24CF65C998B6ABBF0FB55709F01481CE49BC3AA1EB75B848CB61
                                          Function 6A686B40 Relevance: 18.1, APIs: 12, Instructions: 85COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?toLatin1@QString@@QGBE?AVQByteArray@@XZ.QT5CORE(?), ref: 6A686B57
                                          • ?toLatin1@QString@@QGBE?AVQByteArray@@XZ.QT5CORE(?), ref: 6A686B65
                                          • ??0QByteArray@@QAE@HD@Z.QT5CORE(?,00000000), ref: 6A686B85
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE ref: 6A686B8F
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE(?), ref: 6A686BAF
                                          • memmove.VCRUNTIME140(00000002,00000000), ref: 6A686BBA
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE(?), ref: 6A686BE0
                                          • memmove.VCRUNTIME140(00000003,00000000), ref: 6A686BEB
                                          • ?write@QIODevice@@QAE_JABVQByteArray@@@Z.QT5CORE(?), ref: 6A686C03
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A686C22
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A686C2C
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A686C36
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$Array@@$?begin@$Latin1@String@@memmove$?write@Array@@@Device@@
                                          • String ID:
                                          • API String ID: 1133504204-0
                                          • Opcode ID: d796257dfeb4df6e64c9cc839e35a36099e8d678175caffe5e78d10136e65a3f
                                          • Instruction ID: 67ef4bf246c19c83cfc1b6fd2c5e31e49dbdc5697ff1f80ac335ade8d157619e
                                          • Opcode Fuzzy Hash: d796257dfeb4df6e64c9cc839e35a36099e8d678175caffe5e78d10136e65a3f
                                          • Instruction Fuzzy Hash: 8131FC751082429FCB04DF54C89899ABBF8FF99304F09885DF49AC7251DB31ED09CB52
                                          Function 6A68A050 Relevance: 18.1, APIs: 12, Instructions: 82networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?type@QNetworkProxy@@QBE?AW4ProxyType@1@XZ.QT5NETWORK ref: 6A68A062
                                          • ?cast@QMetaObject@@QBEPAVQObject@@PAV2@@Z.QT5CORE(?), ref: 6A68A079
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                            • Part of subcall function 6A6BE2B5: _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2BD
                                            • Part of subcall function 6A6BE2B5: _CxxThrowException.VCRUNTIME140(?,6A6DEF0C), ref: 6A6BF0A4
                                            • Part of subcall function 6A6BE2B5: _CxxThrowException.VCRUNTIME140(?,6A6DE7F8), ref: 6A6BF0C1
                                            • Part of subcall function 6A67ECD0: ??0QObjectPrivate@@QAE@H@Z.QT5CORE(00050F02,00000000,6A68B998,?,?,?), ref: 6A67ECD8
                                            • Part of subcall function 6A67ECD0: ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(0000000D,Unknown error,?,?), ref: 6A67ECF9
                                            • Part of subcall function 6A67ECD0: ??0QHostAddress@@QAE@XZ.QT5NETWORK(?,?), ref: 6A67ED17
                                            • Part of subcall function 6A67ECD0: ??0QHostAddress@@QAE@XZ.QT5NETWORK(?,?), ref: 6A67ED25
                                          • ??0QNetworkProxy@@QAE@XZ.QT5NETWORK ref: 6A68A0B1
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A68A0B9
                                          • ??0QNetworkProxyQuery@@QAE@XZ.QT5NETWORK ref: 6A68A0C2
                                            • Part of subcall function 6A67ECB0: ??0QObject@@IAE@AAVQObjectPrivate@@PAV0@@Z.QT5CORE(6A68B9DE,6A68B9DE,00000000,6A68B9DE,00000000,?,?,?,?,?), ref: 6A67ECBB
                                          • ??4QNetworkProxy@@QAEAAV0@ABV0@@Z.QT5NETWORK(?,00000000), ref: 6A68A117
                                            • Part of subcall function 6A672220: ??1QString@@QAE@XZ.QT5CORE(00000000,?,6A67E24B,?), ref: 6A672255
                                            • Part of subcall function 6A672220: ??1QString@@QAE@XZ.QT5CORE ref: 6A67225E
                                            • Part of subcall function 6A672220: ??1QString@@QAE@XZ.QT5CORE ref: 6A672267
                                          • ?user@QNetworkProxy@@QBE?AVQString@@XZ.QT5NETWORK(?,?,00000000), ref: 6A68A123
                                            • Part of subcall function 6A6683D0: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE ref: 6A6683E4
                                            • Part of subcall function 6A6683D0: ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A6683ED
                                            • Part of subcall function 6A6683D0: ??1QString@@QAE@XZ.QT5CORE ref: 6A6683F7
                                          • ?setUser@QAuthenticator@@QAEXABVQString@@@Z.QT5NETWORK(?,?,00000000), ref: 6A68A13C
                                            • Part of subcall function 6A6698E0: ??8@YA_NABVQString@@0@Z.QT5CORE(?,?), ref: 6A6698EE
                                            • Part of subcall function 6A6698E0: ?detach@QAuthenticator@@QAEXXZ.QT5NETWORK ref: 6A6698FD
                                            • Part of subcall function 6A6698E0: ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A669908
                                          • ?password@QNetworkProxy@@QBE?AVQString@@XZ.QT5NETWORK(?,?,00000000), ref: 6A68A148
                                          • ?setPassword@QAuthenticator@@QAEXABVQString@@@Z.QT5NETWORK(?,?,00000000), ref: 6A68A15E
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000000), ref: 6A68A167
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A68A171
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Network$Proxy@@V0@@$Authenticator@@Object@@String@@@$?setAddress@@Array@@ByteExceptionHostObjectPrivate@@ProxyThrow$??8@?cast@?detach@?password@?type@?user@E@$$Latin1MetaPassword@Query@@String@@0@Type@1@User@V2@@_callnewhmalloc
                                          • String ID:
                                          • API String ID: 2915028747-0
                                          • Opcode ID: 0ad8a2e39df3ca1e4a42f984b4c16c9c4bb50694d5e57626204116a60b636d09
                                          • Instruction ID: bc99df5a957cbf7f4a4e1b23546f473a8ae160da49011ae8127b427659fb189b
                                          • Opcode Fuzzy Hash: 0ad8a2e39df3ca1e4a42f984b4c16c9c4bb50694d5e57626204116a60b636d09
                                          • Instruction Fuzzy Hash: 91314BB06143058BD720DF65C818B5FBBE9FF91358F02481DE89687291DF74E808CBA6
                                          Function 6A642A20 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 221windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 6A642C08
                                          • ?isDebugEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,00000000), ref: 6A642C52
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,00000000), ref: 6A642C6E
                                          • ?debug@QMessageLogger@@QBE?AVQDebug@@XZ.QT5CORE(?,?,?,00000000), ref: 6A642C7B
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE(stream,?,?,00000000), ref: 6A642C88
                                          • ??6QDebug@@QAEAAV0@I@Z.QT5CORE(00000000,?,?,00000000), ref: 6A642C96
                                          • ??6QDebug@@QAEAAV0@PBD@Z.QT5CORE(suspended by flow control,?,?,00000000), ref: 6A642CA3
                                          • ??1QDebug@@QAE@XZ.QT5CORE(?,?,00000000), ref: 6A642CAD
                                            • Part of subcall function 6A63C300: ?write@QIODevice@@QAE_JPBD_J@Z.QT5CORE(?,?,00000000), ref: 6A63C352
                                            • Part of subcall function 6A63C300: ?write@QIODevice@@QAE_JPBD_J@Z.QT5CORE(?,?,00000000), ref: 6A63C37C
                                            • Part of subcall function 6A6BA290: ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(?,6A700D30,00000009,?,?,?,00000000), ref: 6A6BA2C1
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Debug@@$Object@@$?write@Device@@Logger@@Message$?activate@?debug@?disconnect@Category@@D01@DebugEnabled@H00@LoggingMeta
                                          • String ID: stream$suspended by flow control
                                          • API String ID: 1362866496-1471577173
                                          • Opcode ID: c6af9b7f3e73f5fb802085aaa1b8360b0b2f434e60c53851788eb73c3ed4d3c3
                                          • Instruction ID: 53fe099c65d3189c30cd6fe3af3d38486b2dafe0d2ccda4c84305e48a253e034
                                          • Opcode Fuzzy Hash: c6af9b7f3e73f5fb802085aaa1b8360b0b2f434e60c53851788eb73c3ed4d3c3
                                          • Instruction Fuzzy Hash: 56818C712042108FCB44DF64C894AAAB7F5EF89304F01456CF95ADB292DF31ED0ACBA1
                                          Function 6A68C940 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 95windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68C95F
                                            • Part of subcall function 6A68E9D0: WSARecv.WS2_32(?,?,00000001,?), ref: 6A68EA12
                                            • Part of subcall function 6A68E9D0: WSAGetLastError.WS2_32 ref: 6A68EA1C
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNativeSocketEngine::read() was called not in QAbstractSocket::ConnectedState or QAbstractSocket::BoundState), ref: 6A68C96B
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68C998
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,The remote host closed the connection), ref: 6A68C9E8
                                          • ?qt_error_string@@YA?AVQString@@H@Z.QT5CORE(?,00000000), ref: 6A68CA12
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A68CA1F
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A68CA29
                                          Strings
                                          • QNativeSocketEngine::read() was called not in QAbstractSocket::ConnectedState or QAbstractSocket::BoundState, xrefs: 6A68C99E
                                          • The remote host closed the connection, xrefs: 6A68C9CE
                                          • QNativeSocketEngine::read() was called on an uninitialized socket device, xrefs: 6A68C965
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@MessageString@@$?qt_error_string@@?tr@?warning@DateErrorLastMetaObject@@RecvTime@@V0@$$V0@@
                                          • String ID: QNativeSocketEngine::read() was called not in QAbstractSocket::ConnectedState or QAbstractSocket::BoundState$QNativeSocketEngine::read() was called on an uninitialized socket device$The remote host closed the connection
                                          • API String ID: 3203475252-193179729
                                          • Opcode ID: 99e6a85ceb93b71364f5d9c074e4d6ccf96957c07038f3ec2d8a2a1c422afa99
                                          • Instruction ID: f7288a5f3426933518fd40cf1b0eafee950b7844cefdfd67d7bf4c1388d47c51
                                          • Opcode Fuzzy Hash: 99e6a85ceb93b71364f5d9c074e4d6ccf96957c07038f3ec2d8a2a1c422afa99
                                          • Instruction Fuzzy Hash: 0331A1B16086009FDB50CA28CD84B4ABBF9FF95725F500729F157E22D0DF64F9048762
                                          Function 6A628170 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 52COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: V0@@$DateTime@@$Url@@
                                          • String ID: \%pj$\%pj$`%pj$d%pj$h%pj
                                          • API String ID: 2561866314-407359015
                                          • Opcode ID: 12363aac66d6149fb242d2a571c7562da5197b6fda54731d35e01c24fabcfb3d
                                          • Instruction ID: c8c51f16d157b99255c212b12965c55567de670ca895597e41e7521f7ca89a58
                                          • Opcode Fuzzy Hash: 12363aac66d6149fb242d2a571c7562da5197b6fda54731d35e01c24fabcfb3d
                                          • Instruction Fuzzy Hash: 23113DF6A402408BDF14DB689A6C94437F2AB87364B1502F9E612C73D1EF349D458B9A
                                          Function 6A6AA8E0 Relevance: 16.7, APIs: 11, Instructions: 169COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A6AA8FB
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(?,00000001), ref: 6A6AA99A
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A6AA9C4
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A6AA9FB
                                          • ??1QSslCertificate@@QAE@XZ.QT5NETWORK ref: 6A6AAA47
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?), ref: 6A6AAA51
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A6AAA6D
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(00000000), ref: 6A6AAA81
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(00000000), ref: 6A6AAA88
                                          • ??1QSslCertificate@@QAE@XZ.QT5NETWORK ref: 6A6AAA9A
                                            • Part of subcall function 6A6A4D30: ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A695360,?,?,00000094,6A695A8E), ref: 6A6A4D43
                                            • Part of subcall function 6A6A4D30: ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,00000094,6A695A8E), ref: 6A6A4D5E
                                            • Part of subcall function 6A6A4D30: ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,X509_free,?,?,00000094,6A695A8E), ref: 6A6A4D6F
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?), ref: 6A6AAAAD
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Certificate@@$V0@@$Data@@List$?data@Char@@Logger@@MessageString@@$?append@?detach_grow@?dispose@?warning@Category@@Data@1@Data@1@@Enabled@H00@LoggingWarning
                                          • String ID:
                                          • API String ID: 4123702877-0
                                          • Opcode ID: 1d2c68957d0f0c68b273ca1235811661d803a5ace56e39f4209cace3f98b4dc9
                                          • Instruction ID: 5d1dee2787c3e069c68e943213ccb098c9a4954bf6869b8dcf213ca944b9d61a
                                          • Opcode Fuzzy Hash: 1d2c68957d0f0c68b273ca1235811661d803a5ace56e39f4209cace3f98b4dc9
                                          • Instruction Fuzzy Hash: 6151D372A042159FCB00DF58D88055AB7F1FF85314F06862EEA6A97351EF31ED4ACB86
                                          Function 6A674090 Relevance: 16.6, APIs: 11, Instructions: 83timeCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                            • Part of subcall function 6A6741C0: ??0QString@@QAE@XZ.QT5CORE(?,6A673FA5), ref: 6A6741C3
                                            • Part of subcall function 6A6741C0: ??0QString@@QAE@XZ.QT5CORE ref: 6A6741D3
                                            • Part of subcall function 6A6741C0: ??0QString@@QAE@XZ.QT5CORE ref: 6A6741DC
                                            • Part of subcall function 6A6741C0: ??0QDateTime@@QAE@XZ.QT5CORE ref: 6A6741F3
                                            • Part of subcall function 6A6741C0: ??0QDateTime@@QAE@XZ.QT5CORE ref: 6A6741FC
                                          • ?path@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A6740C3
                                          • ??0QFileInfo@@QAE@ABVQString@@@Z.QT5CORE(00000000), ref: 6A6740CE
                                          • ?fileName@QFileInfo@@QBE?AVQString@@XZ.QT5CORE(?), ref: 6A6740DB
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A6740E5
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6740EF
                                          • ??1QFileInfo@@QAE@XZ.QT5CORE ref: 6A6740F9
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A674103
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A674123
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A67412F
                                          • ??4QDateTime@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A674152
                                          • ??4QDateTime@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A67415E
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$DateTime@@V0@@$FileInfo@@$?file?path@ComponentFlags@FormattingName@Option@String@@@Url@@Url@@@@@V0@$$malloc
                                          • String ID:
                                          • API String ID: 2820912901-0
                                          • Opcode ID: de96e0af4e4b75931cfb81515a3da3443a9aa073942e05f4099f60d5766b217b
                                          • Instruction ID: 4548843e8cb56641e4fcd222fc2aedc104fd97e09e01ea8a7803d614d1ada657
                                          • Opcode Fuzzy Hash: de96e0af4e4b75931cfb81515a3da3443a9aa073942e05f4099f60d5766b217b
                                          • Instruction Fuzzy Hash: 83312DB9109242AFC705DF68C56496AFFF1BF99204B04465DE49A83342DB31FD15CBA2
                                          Function 6A68C8D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 133windownetworkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68C8EC
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNativeSocketEngine::pendingDatagramSize() was called by a socket other than QAbstractSocket::UdpSocket), ref: 6A68C8F8
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68C91B
                                          • WSARecv.WS2_32(?,?,?,?,?,?,?), ref: 6A68E951
                                          • WSAGetLastError.WS2_32(?,?,?), ref: 6A68E959
                                          • free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?), ref: 6A68E9AB
                                          Strings
                                          • , xrefs: 6A68E8DE, 6A68E8F6, 6A68C8E0
                                          • QNativeSocketEngine::pendingDatagramSize() was called by a socket other than QAbstractSocket::UdpSocket, xrefs: 6A68C921
                                          • QNativeSocketEngine::pendingDatagramSize() was called on an uninitialized socket device, xrefs: 6A68C8F2
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?warning@ErrorLastRecvfree
                                          • String ID: $QNativeSocketEngine::pendingDatagramSize() was called by a socket other than QAbstractSocket::UdpSocket$QNativeSocketEngine::pendingDatagramSize() was called on an uninitialized socket device
                                          • API String ID: 503401749-466110667
                                          • Opcode ID: 3c927403053a56bb613e9b0c0f565c907859d7a8b10fd686288fb18eb2798473
                                          • Instruction ID: d74a67831d0f19a8417f2b5497eb97bbc45f763fb73f1711061a8a4efeaaa8e1
                                          • Opcode Fuzzy Hash: 3c927403053a56bb613e9b0c0f565c907859d7a8b10fd686288fb18eb2798473
                                          • Instruction Fuzzy Hash: 53515CB1948301AFDB14DF69C844B5AB7F8FF86314F118A1DE4A597290DBB0E909CF92
                                          Function 6A6B6AD0 Relevance: 15.2, APIs: 10, Instructions: 168COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6A3A70: ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A6B2193,?,?,?,?,6A6B1B6E,?,?,?,?,?,?,?,?), ref: 6A6A3A83
                                            • Part of subcall function 6A6A3A70: ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,6A6B1B6E,?,?,?,?,?,?,?,?), ref: 6A6A3A9E
                                            • Part of subcall function 6A6A3A70: ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,SSL_get_peer_certificate,?,?,6A6B1B6E,?,?,?,?,?,?,?,?), ref: 6A6A3AAF
                                            • Part of subcall function 6A6AA5E0: ??0QString@@QAE@XZ.QT5CORE(00000000,?,?,?,00000000), ref: 6A6AA5EB
                                            • Part of subcall function 6A6AA5E0: ??0QSslCertificate@@QAE@ABVQByteArray@@W4EncodingFormat@QSsl@@@Z.QT5NETWORK(00000000), ref: 6A6AA5F6
                                            • Part of subcall function 6A6AA5E0: ??1QByteArray@@QAE@XZ.QT5CORE(00000000), ref: 6A6AA5FF
                                            • Part of subcall function 6A6AA5E0: ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A6AA645
                                            • Part of subcall function 6A6AA5E0: ??1QDateTime@@QAE@XZ.QT5CORE ref: 6A6AA655
                                            • Part of subcall function 6A6AA5E0: ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A6AA66D
                                            • Part of subcall function 6A6AA5E0: ??1QDateTime@@QAE@XZ.QT5CORE ref: 6A6AA677
                                            • Part of subcall function 6A6AA5E0: ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A6AA699
                                            • Part of subcall function 6A6AA5E0: ??1QSslCertificate@@QAE@XZ.QT5NETWORK(?), ref: 6A6AA6A2
                                          • ??1QSslCertificate@@QAE@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,6A6B5ABB), ref: 6A6B6B0C
                                            • Part of subcall function 6A6A4D30: ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A695360,?,?,00000094,6A695A8E), ref: 6A6A4D43
                                            • Part of subcall function 6A6A4D30: ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,00000094,6A695A8E), ref: 6A6A4D5E
                                            • Part of subcall function 6A6A4D30: ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,X509_free,?,?,00000094,6A695A8E), ref: 6A6A4D6F
                                            • Part of subcall function 6A6A3A10: ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,?,6A6B21EA,?,?,?,?,?,6A6B1B6E,?), ref: 6A6A3A23
                                            • Part of subcall function 6A6A3A10: ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,?,6A6B21EA,?,?,?,?,?,6A6B1B6E,?), ref: 6A6A3A3E
                                            • Part of subcall function 6A6A3A10: ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,SSL_get_peer_cert_chain,?,?,?,6A6B21EA,?,?,?,?,?,6A6B1B6E,?), ref: 6A6A3A4F
                                            • Part of subcall function 6A6AE1F0: ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(00000000,7FFFFFFF,00000001,?,?,?,00000000,?,?,?,?,?,6A6B1B6E,?), ref: 6A6AE254
                                            • Part of subcall function 6A6AE1F0: ??1QSslCertificate@@QAE@XZ.QT5NETWORK(?,?,?,00000000,?,?,?,?,?,6A6B1B6E,?), ref: 6A6AE279
                                            • Part of subcall function 6A695320: ??1QSslCertificate@@QAE@XZ.QT5NETWORK(?,?,00000094,6A695A8E), ref: 6A69535B
                                            • Part of subcall function 6A695320: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000094,?,?,00000094,6A695A8E), ref: 6A695365
                                          • ?isNull@QSslKey@@QBE_NXZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,?,6A6B5ABB), ref: 6A6B6B6D
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(?,00000001), ref: 6A6B6BBE
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(00000000), ref: 6A6B6BF3
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(00000000), ref: 6A6B6C33
                                          • ??1QSslCertificate@@QAE@XZ.QT5NETWORK ref: 6A6B6C76
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000), ref: 6A6B6C80
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A6B5ABB), ref: 6A6B6CA1
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A6B6CB3
                                          • ?prepend@QListData@@QAEPAPAXXZ.QT5CORE(?), ref: 6A6B6CBA
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Certificate@@$V0@@$Logger@@Message$Data@@DateListTime@@$?warning@Category@@Enabled@H00@LoggingWarning$?dispose@Array@@ByteData@1@@V0@$$$?detach_grow@?prepend@Data@1@EncodingFormat@Key@@Null@Ssl@@@String@@
                                          • String ID:
                                          • API String ID: 588499406-0
                                          • Opcode ID: 6cb2475d78cef2ccb81e73ad82c10d628848c49609700d5d3d8ba0f2a9fd9309
                                          • Instruction ID: 26b6e3dcb1b98f00a61e42301272d59ad22a46da1a0a22de26085b91d182bfb4
                                          • Opcode Fuzzy Hash: 6cb2475d78cef2ccb81e73ad82c10d628848c49609700d5d3d8ba0f2a9fd9309
                                          • Instruction Fuzzy Hash: C851D1766002118FCB04DF18C88095AB7B1FF84318F1A456DED1AAB352DF32ED1ACB95
                                          Function 6A692BE0 Relevance: 15.1, APIs: 10, Instructions: 104COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??5QDataStream@@QAEAAV0@AAC@Z.QT5CORE(?,00000000,?,6BB4C360,?,?,?,?,6A692D31,?,?,?,?,?,?,6A698440), ref: 6A692BFC
                                          • ??5QDataStream@@QAEAAV0@AAC@Z.QT5CORE(?), ref: 6A692C19
                                          • ??5QDataStream@@QAEAAV0@AAC@Z.QT5CORE(?), ref: 6A692C47
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A692C85
                                          • ?resize@QByteArray@@QAEXH@Z.QT5CORE(?), ref: 6A692C90
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE ref: 6A692CA1
                                          • ?readRawData@QDataStream@@QAEHPADH@Z.QT5CORE(00000000,00000000), ref: 6A692CAB
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A692CBB
                                          • ?swap@QByteArray@@QAEXAAV1@@Z.QT5CORE(?), ref: 6A692CDF
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A692CEB
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$DataStream@@$?begin@?read?resize@?swap@Data@String@@V1@@
                                          • String ID:
                                          • API String ID: 713917278-0
                                          • Opcode ID: 6201fdbfdac877e2a2825edcbcd9e3a1b8a9d06aafcda77db6928b66110c29bd
                                          • Instruction ID: 7783f72ba93e3de726e341520c1510a880ee524ef82aa0ecb5efaeb79c18e0b1
                                          • Opcode Fuzzy Hash: 6201fdbfdac877e2a2825edcbcd9e3a1b8a9d06aafcda77db6928b66110c29bd
                                          • Instruction Fuzzy Hash: 563138B29443068FCB04DF69C4445EBFBF4EB96210F46056AF896D3241DA34E90EDBB2
                                          Function 6A630080 Relevance: 15.1, APIs: 10, Instructions: 101COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?trimmed@QStringRef@@QBE?AV1@XZ.QT5CORE(?), ref: 6A6300C3
                                          • ??0QString@@QAE@HW4Initialization@Qt@@@Z.QT5CORE(?,00000000), ref: 6A6300D9
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A6300E3
                                          • ?constData@QStringRef@@QBEPBVQChar@@XZ.QT5CORE ref: 6A6300F4
                                          • memmove.VCRUNTIME140(00000000,00000000), ref: 6A6300FC
                                          • ?appendLatin1To@QAbstractConcatenable@@KAXPBDHPAVQChar@@@Z.QT5CORE(?,?,00000000,00000000,00000000), ref: 6A63010C
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,7FFFFFFF,00000001), ref: 6A63014D
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A63015E
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE ref: 6A630168
                                          • ??1QString@@QAE@XZ.QT5CORE(00000000), ref: 6A6301BB
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Array@@ByteChar@@Ref@@StringV0@@$?append?append@?const?data@?trimmed@AbstractChar@@@Concatenable@@Data@Data@@Initialization@Latin1ListQt@@@memmove
                                          • String ID:
                                          • API String ID: 3731555167-0
                                          • Opcode ID: 347c2efc3d76123c40eb84eefdfa04401167df44ade7d90cd00574d9ed82d34e
                                          • Instruction ID: 58c1b70acc8412c3cb27fc9b5988eeff0ec86e752103310a82a26f57fb5bc19c
                                          • Opcode Fuzzy Hash: 347c2efc3d76123c40eb84eefdfa04401167df44ade7d90cd00574d9ed82d34e
                                          • Instruction Fuzzy Hash: BF4149711043019FD704DF65C898AAABBF4EF89314F02492DF596872A0EF74ED49CB92
                                          Function 6A66A140 Relevance: 15.1, APIs: 10, Instructions: 80COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??6QDataStream@@QAEAAV0@_N@Z.QT5CORE(?), ref: 6A66A169
                                          • ??6QDataStream@@QAEAAV0@_N@Z.QT5CORE(?), ref: 6A66A198
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(-00000004), ref: 6A66A1B2
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A66A1BD
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A66A1CD
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A66A1D8
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A66A1E2
                                          • ??6@YAAAVQDataStream@@AAV0@ABVQString@@@Z.QT5CORE(?,?), ref: 6A66A1EE
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A66A1FB
                                          • ??6QDataStream@@QAEAAV0@H@Z.QT5CORE(?), ref: 6A66A21A
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DataStream@@$Array@@ByteString@@V0@@$E@$$V0@_$??6@String@@@
                                          • String ID:
                                          • API String ID: 262864894-0
                                          • Opcode ID: c37f06e35475abf45c07358258ce5e2f2598392366e63c8846a0d4372d8ade07
                                          • Instruction ID: 457c82026bac7e0cbf2fc4ac5eaaa2d39de2fb54855ec9974e5e34ff9ac4968a
                                          • Opcode Fuzzy Hash: c37f06e35475abf45c07358258ce5e2f2598392366e63c8846a0d4372d8ade07
                                          • Instruction Fuzzy Hash: 5C21EEB26042409FCB04DF6AD89497EB7F8FB99205F45481DF456C2281DF30EE4ACB92
                                          Function 6A65EBA0 Relevance: 15.1, APIs: 10, Instructions: 60COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QString@@QAE@XZ.QT5CORE(?,6BB48B70,00000000,6A65DB98,?,?,00000000), ref: 6A65EBA9
                                          • ?reserve@QByteArray@@QAEXH@Z.QT5CORE(?), ref: 6A65EBCA
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(?,00000004), ref: 6A65EBE6
                                          • ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(?), ref: 6A65EBF9
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A65EBFF
                                          • ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(?), ref: 6A65EC0C
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(?,00000004), ref: 6A65EC25
                                          • ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(?), ref: 6A65EC32
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A65EC38
                                          • ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(?), ref: 6A65EC41
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?append@V1@@$?reserve@String@@
                                          • String ID:
                                          • API String ID: 187460552-0
                                          • Opcode ID: 2fb6135d8024ddb0019888530942021cf435eb521cb3fab705a9a342dc82e986
                                          • Instruction ID: 6410c0857562272570a9ae8a438f19e10cac7cabb8049b431969688fbe8bce22
                                          • Opcode Fuzzy Hash: 2fb6135d8024ddb0019888530942021cf435eb521cb3fab705a9a342dc82e986
                                          • Instruction Fuzzy Hash: 6811D3B520434A9FCB04DF59D89896AB7F9FBC9205F06482DF646C7291DA30FD09CB62
                                          Function 6A670A70 Relevance: 15.1, APIs: 10, Instructions: 56COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A670A97
                                          • ?realm@QAuthenticator@@QBE?AVQString@@XZ.QT5NETWORK(?), ref: 6A670AA9
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A670AB8
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A670AC1
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A670AD3
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A670AE2
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A670AF2
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A670B05
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A670B0E
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A670B18
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Array@@ByteV0@@$E@$$$?realm@Authenticator@@
                                          • String ID:
                                          • API String ID: 3308721931-0
                                          • Opcode ID: 2c7ca77c3bdf8a8c94037f36c8629d84ccf1b09ce7cb8ff500c916441c9e1bb0
                                          • Instruction ID: 2d6d0ad66dc91ab0bb576f4bbc753e9ee097893d076615afb8415846c34d3bcc
                                          • Opcode Fuzzy Hash: 2c7ca77c3bdf8a8c94037f36c8629d84ccf1b09ce7cb8ff500c916441c9e1bb0
                                          • Instruction Fuzzy Hash: 0F1149B12002019FD700DF54D8A8B9A77F4EF95705F024419F557C32A2DF31AE48CBA2
                                          Function 6A670360 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A670550: ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(?,6BB6C190,?,?,6BB6C190,?,?,?,?), ref: 6A6705BA
                                            • Part of subcall function 6A670550: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,?,?,?,?,?), ref: 6A670631
                                          • ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(?,?,?,?,6BB6C190,?,?,?,?), ref: 6A6703C1
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,?,?,?,?,?), ref: 6A67042C
                                          • ?realloc@QListData@@QAEXH@Z.QT5CORE(?,?,?,?,6BB6C190,?,?,?,?), ref: 6A67043A
                                          • ??1QString@@QAE@XZ.QT5CORE(00000020,?,?,?,?,6BB6C190,?,?,?,?), ref: 6A6704C3
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?), ref: 6A6704CC
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?), ref: 6A6704D5
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,?,?,?,?,6BB6C190,?,?,?,?), ref: 6A670538
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@List$?dispose@Data@1@@String@@$?detach@Data@1@$?realloc@
                                          • String ID: <.pj
                                          • API String ID: 1630365453-724697695
                                          • Opcode ID: 2aa61235ec006ecd625433f5eafc4b37dac26e8942325d23d3ff139452a67cca
                                          • Instruction ID: 70a999c61f622728adbf22ae12ae60c12348e479722eba3bcd9361146670513e
                                          • Opcode Fuzzy Hash: 2aa61235ec006ecd625433f5eafc4b37dac26e8942325d23d3ff139452a67cca
                                          • Instruction Fuzzy Hash: 76515D70210212DBEB20DF68C894A1AB3F4FF49318B164568E55AD7295EF31F919CBA1
                                          Function 6A68C090 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 77windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68C0AC
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNativeSocketEngine::connectToHost() was called on an uninitialized socket device), ref: 6A68C0B8
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A68C0F6
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNativeSocketEngine::connectToHost() was called not in QAbstractSocket::BoundState or QAbstractSocket::UnconnectedState), ref: 6A68C102
                                          Strings
                                          • QNativeSocketEngine::connectToHost() was called not in QAbstractSocket::BoundState or QAbstractSocket::UnconnectedState, xrefs: 6A68C0FC
                                          • QNativeSocketEngine::connectToHost() was called on an uninitialized socket device, xrefs: 6A68C0B2
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?warning@
                                          • String ID: QNativeSocketEngine::connectToHost() was called not in QAbstractSocket::BoundState or QAbstractSocket::UnconnectedState$QNativeSocketEngine::connectToHost() was called on an uninitialized socket device
                                          • API String ID: 3543197520-325447755
                                          • Opcode ID: 7d453c26c83cbc5d206eafa26eda8fad8f0d2221327be03a354a4c83031cdaf3
                                          • Instruction ID: b961f04f438ddae3621563379d28dcb30219eb324230d64edcacafb931f39530
                                          • Opcode Fuzzy Hash: 7d453c26c83cbc5d206eafa26eda8fad8f0d2221327be03a354a4c83031cdaf3
                                          • Instruction Fuzzy Hash: 2B11C3B12402006BCB10E6688C9AF9B73ECAF96619F510519F987D7191DF15F908C7B6
                                          Function 6A6240C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(?,00000000,?,00000000), ref: 6A6240F0
                                          • ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(?,00000000,?,00000000), ref: 6A624109
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Operation canceled,00000000,000000FF), ref: 6A62412C
                                          • ??1QString@@QAE@XZ.QT5CORE(00000005,?), ref: 6A624144
                                          • ?deleteLater@QObject@@QAEXXZ.QT5CORE ref: 6A624178
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$?disconnect@D01@String@@$?delete?tr@Later@Meta
                                          • String ID: Operation canceled$P)lj
                                          • API String ID: 1667799998-4146923076
                                          • Opcode ID: 4d575cbe85fdd616074d825e0b9cde1d1881287ed43e0ced68cf776f2d2f685f
                                          • Instruction ID: f44590894324c5726bdfe4080ebab98fb8cf126553900bc5ecc4b26a9b973d13
                                          • Opcode Fuzzy Hash: 4d575cbe85fdd616074d825e0b9cde1d1881287ed43e0ced68cf776f2d2f685f
                                          • Instruction Fuzzy Hash: AC1142702403016BFB249B65CC0DBAB76E9EB85755F12092CE66BD72D1CFB0B840CA55
                                          Function 6A662390 Relevance: 13.6, APIs: 9, Instructions: 143threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?lock@QMutex@@QAEXXZ.QT5CORE ref: 6A6623AA
                                          • ?quit@QThread@@QAEXXZ.QT5CORE ref: 6A662443
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE ref: 6A66244D
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(?), ref: 6A66247F
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(?), ref: 6A6624A7
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A616160), ref: 6A6624CF
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?), ref: 6A6624EE
                                          • ??1QFactoryLoader@@UAE@XZ.QT5CORE ref: 6A6624FA
                                          • ??1QRecursiveMutex@@QAE@XZ.QT5CORE ref: 6A662502
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@$?free_helper@HashNode@1@@$Mutex@@$?dispose@?lock@?quit@?unlock@Data@1@@FactoryListLoader@@Locker@@MutexRecursiveThread@@
                                          • String ID:
                                          • API String ID: 602135461-0
                                          • Opcode ID: ebc6e4df438d11e73845052914ae00b36dfc3582a9ea7fd8cc32ed9c1d5daf7b
                                          • Instruction ID: 9786ab47b332bebd39d529486afed93f9eb4d1d610d3d070ddbd14d22263bf03
                                          • Opcode Fuzzy Hash: ebc6e4df438d11e73845052914ae00b36dfc3582a9ea7fd8cc32ed9c1d5daf7b
                                          • Instruction Fuzzy Hash: 5141C5706012069BEB04CFB9C88052977B4FF4632872642ADE826CB6D0DF35EC56CB92
                                          Function 6A61AA10 Relevance: 13.6, APIs: 9, Instructions: 140networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QVariant@@QAE@H@Z.QT5CORE(00000000), ref: 6A625208
                                          • ?attribute@QNetworkRequest@@QBE?AVQVariant@@W4Attribute@1@ABV2@@Z.QT5NETWORK(?,0000000D,?), ref: 6A625220
                                          • ?toInt@QVariant@@QBEHPA_N@Z.QT5CORE(00000000,?,0000000D,?), ref: 6A62522E
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A625258
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A625263
                                          • ?cookieJar@QNetworkAccessManager@@QBEPAVQNetworkCookieJar@@XZ.QT5NETWORK ref: 6A62528B
                                          • ?userType@QVariant@@QBEHXZ.QT5CORE ref: 6A6252A6
                                          • ?constData@QVariant@@QBEPBXXZ.QT5CORE ref: 6A6252B2
                                          • ?convert@QVariant@@QBE_NHPAX@Z.QT5CORE(00000000,?), ref: 6A6252D3
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Variant@@$Network$?attribute@?const?convert@?cookie?userAccessAttribute@1@CookieData@Int@Jar@Jar@@Manager@@Request@@Type@V2@@
                                          • String ID:
                                          • API String ID: 1952956893-0
                                          • Opcode ID: acaa5fe3c363cc72beaa08a1a9ec1a46abe80100ec900e494d6dc8f358668467
                                          • Instruction ID: bbd1007aea73e64bfdedf08fa22c6e4944be5fed49c6343e5a54d0ceaab7a71b
                                          • Opcode Fuzzy Hash: acaa5fe3c363cc72beaa08a1a9ec1a46abe80100ec900e494d6dc8f358668467
                                          • Instruction Fuzzy Hash: 6F518E316093029FE724DFA8C488B9AB7E4BB45704F42452DE856DB295EF74ED08CB92
                                          Function 6A656200 Relevance: 13.6, APIs: 9, Instructions: 127networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QVariant@@QAE@H@Z.QT5CORE(00000000,?,?,6BB6C190,6BBE0EA0,?,?,?,?,?,?,?,?,?,?,6A65BE8B), ref: 6A656267
                                          • ?attribute@QNetworkRequest@@QBE?AVQVariant@@W4Attribute@1@ABV2@@Z.QT5NETWORK(?,0000000D,?,?,?,?,?,?,?,?,?,?,?,6A65BE8B,?), ref: 6A656283
                                          • ?toInt@QVariant@@QBEHPA_N@Z.QT5CORE(00000000,?,0000000D,?,?,?,?,?,?,?,?,?,?,?,6A65BE8B,?), ref: 6A656291
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A6562C3
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A6562CE
                                          • ?cookieJar@QNetworkAccessManager@@QBEPAVQNetworkCookieJar@@XZ.QT5NETWORK ref: 6A6562E1
                                          • ?userType@QVariant@@QBEHXZ.QT5CORE ref: 6A6562FC
                                          • ?constData@QVariant@@QBEPBXXZ.QT5CORE ref: 6A656308
                                          • ?convert@QVariant@@QBE_NHPAX@Z.QT5CORE(00000000,?), ref: 6A656329
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Variant@@$Network$?attribute@?const?convert@?cookie?userAccessAttribute@1@CookieData@Int@Jar@Jar@@Manager@@Request@@Type@V2@@
                                          • String ID:
                                          • API String ID: 1952956893-0
                                          • Opcode ID: 93adac36e13f6a125d02df674706b6cf08df2ac5bb130a234b2b8cc047a8c292
                                          • Instruction ID: eb45db8c3d0fc41e58a555b5a39adfa22b98f33e69303c83277a87ba309e00bb
                                          • Opcode Fuzzy Hash: 93adac36e13f6a125d02df674706b6cf08df2ac5bb130a234b2b8cc047a8c292
                                          • Instruction Fuzzy Hash: 5A419E756086029FC700CFA9C484B9AFBE4BB85314F0A452DE856D7251EF70ED59CBD2
                                          Function 6A694870 Relevance: 13.6, APIs: 9, Instructions: 111COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?fromUtf8@QString@@SA?AV1@PBDH@Z.QT5CORE(?,6A6D00B4,000000FF,00000000,?,00000000,?,6A6B2FA1,?,00000000,00000000,00000000), ref: 6A6948AD
                                          • ?serialNumber@QSslCertificate@@QBE?AVQByteArray@@XZ.QT5NETWORK(?), ref: 6A6948C2
                                            • Part of subcall function 6A6ABB50: ?lock@QMutex@@QAEXXZ.QT5CORE(6A6D0084,00000000,?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABB73
                                            • Part of subcall function 6A6ABB50: ??0QString@@QAE@XZ.QT5CORE(00000000,?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABBA8
                                            • Part of subcall function 6A6ABB50: ?reserve@QByteArray@@QAEXH@Z.QT5CORE(?,?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABBB8
                                            • Part of subcall function 6A6ABB50: ?number@QByteArray@@SA?AV1@HH@Z.QT5CORE(?,?,00000010,?,?,?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABBDF
                                            • Part of subcall function 6A6ABB50: ?rightJustified@QByteArray@@QBE?AV1@HD_N@Z.QT5CORE(?,00000002,00000030,00000000,?,?,?,?,?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABBF5
                                            • Part of subcall function 6A6ABB50: ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(00000000,?,?,?,?,?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABBFC
                                            • Part of subcall function 6A6ABB50: ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABC06
                                            • Part of subcall function 6A6ABB50: ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABC10
                                            • Part of subcall function 6A6ABB50: ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(0000003A,?,?,?,?,?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABC1C
                                            • Part of subcall function 6A6ABB50: ?chop@QByteArray@@QAEXH@Z.QT5CORE(00000001,?,?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABC2E
                                            • Part of subcall function 6A6ABB50: ??4QByteArray@@QAEAAV0@ABV0@@Z.QT5CORE(?,?,?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABC3E
                                            • Part of subcall function 6A6ABB50: ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABC48
                                            • Part of subcall function 6A6ABB50: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(6A6D008C,6A6D0084,00000000,?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABC59
                                            • Part of subcall function 6A6ABB50: ?unlock@QMutexLocker@@QAEXXZ.QT5CORE(?,?,6A69477B,?,?,?,6BB9ECB0), ref: 6A6ABC63
                                          • ?qstrcmp@@YAHABVQByteArray@@PBD@Z.QT5CORE(00000000,6A6D0084,?), ref: 6A6948CD
                                          • ?subjectInfo@QSslCertificate@@QBE?AVQStringList@@W4SubjectInfo@1@@Z.QT5NETWORK(?,00000001,?), ref: 6A6948F9
                                          • ?QStringList_contains@QtPrivate@@YA_NPBVQStringList@@ABVQString@@W4CaseSensitivity@Qt@@@Z.QT5CORE(00000000,?,00000001,?,00000001,?), ref: 6A69490C
                                          • ?issuerInfo@QSslCertificate@@QBE?AVQStringList@@W4SubjectInfo@1@@Z.QT5NETWORK(?,00000001), ref: 6A694921
                                          • ?QStringList_contains@QtPrivate@@YA_NPBVQStringList@@ABVQString@@W4CaseSensitivity@Qt@@@Z.QT5CORE(00000000,?,00000001,?,00000001), ref: 6A69492E
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A69496C
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A694976
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$String$String@@$List@@$Certificate@@$?append@CaseInfo@Info@1@@List_contains@Private@@Qt@@@Sensitivity@SubjectV0@@$?chop@?from?issuer?lock@?number@?qstrcmp@@?reserve@?right?serial?subject?unlock@Justified@Locker@@MutexMutex@@Number@Utf8@V1@@
                                          • String ID:
                                          • API String ID: 895007878-0
                                          • Opcode ID: 7ef75ad0241b2d369b3727922c3fa7e8045ae5baa8d09e19df1b9196a15118c5
                                          • Instruction ID: 99d61d204fb50398678ff12dc7b9f2fa240e582be6bc75a01b04331da267b65d
                                          • Opcode Fuzzy Hash: 7ef75ad0241b2d369b3727922c3fa7e8045ae5baa8d09e19df1b9196a15118c5
                                          • Instruction Fuzzy Hash: 0531187150430A5FCB00DF64C889B9A7BE4EF46318F46062DF97697182EF75990CC7A2
                                          Function 6A6960B0 Relevance: 13.6, APIs: 9, Instructions: 107COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isNull@QSslKey@@QBE_NXZ.QT5NETWORK ref: 6A696114
                                          • ?defaultParameters@QSslDiffieHellmanParameters@@SA?AV1@XZ.QT5NETWORK(?), ref: 6A696126
                                            • Part of subcall function 6A697580: ??0QMutex@@QAE@XZ.QT5CORE(6A699B97), ref: 6A697591
                                            • Part of subcall function 6A697580: ??0QString@@QAE@XZ.QT5CORE ref: 6A6975A1
                                            • Part of subcall function 6A697580: ??0QByteArray@@QAE@PBDH@Z.QT5CORE(000000FF), ref: 6A6975BC
                                            • Part of subcall function 6A697580: ?fromBase64@QByteArray@@SA?AV1@ABV1@@Z.QT5CORE(?,00000000), ref: 6A6975C8
                                            • Part of subcall function 6A697580: ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A6975D7
                                            • Part of subcall function 6A697580: ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6975E1
                                            • Part of subcall function 6A697580: ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6975EB
                                          • ??8@YA_NABVQSslDiffieHellmanParameters@@0@Z.QT5NETWORK(?,00000000,?), ref: 6A696137
                                            • Part of subcall function 6A6974F0: ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,6A69573C,-0000003C,?,?), ref: 6A69750F
                                            • Part of subcall function 6A6974F0: ?data@QString@@QBEPBVQChar@@XZ.QT5CORE(?,?,?,6A69573C,-0000003C,?,?), ref: 6A69751A
                                          • ?isNull@QSslKey@@QBE_NXZ.QT5NETWORK ref: 6A696157
                                          • ?isNull@QSslKey@@QBE_NXZ.QT5NETWORK ref: 6A696165
                                          • ?isNull@QByteArray@@QBE_NXZ.QT5CORE ref: 6A696193
                                          • ?isNull@QByteArray@@QBE_NXZ.QT5CORE ref: 6A6961A4
                                          • ?isNull@QByteArray@@QBE_NXZ.QT5CORE ref: 6A6961BA
                                          • ??1QSslDiffieHellmanParameters@@QAE@XZ.QT5NETWORK ref: 6A6961E4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$Null@$DiffieHellmanKey@@String@@$?data@Char@@Parameters@@$??8@?default?fromBase64@DateMutex@@Parameters@Parameters@@0@Time@@V0@$$V0@@V1@@
                                          • String ID:
                                          • API String ID: 2945932785-0
                                          • Opcode ID: b2aea6725def81c37dfe37495056913cf7001c236f4626f0ddf5b119a3eb8b7f
                                          • Instruction ID: 64feaa757c2bcd0c9a824af5c3af1125016010b7b074ec73b3665d02a99c76a4
                                          • Opcode Fuzzy Hash: b2aea6725def81c37dfe37495056913cf7001c236f4626f0ddf5b119a3eb8b7f
                                          • Instruction Fuzzy Hash: 744160785083178FD748DF58C4A4A54BBB2BF41318F19859ECAA94B243DF32E896DBD0
                                          Function 6A63E200 Relevance: 13.6, APIs: 9, Instructions: 93COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6405C0: ?createData@QMapDataBase@@SAPAU1@XZ.QT5CORE(?,?,6A63E210), ref: 6A6405D1
                                            • Part of subcall function 6A6405C0: ?setParent@QMapNodeBase@@QAEXPAU1@@Z.QT5CORE(00000008,00000000,?,?,6A63E210), ref: 6A6405F1
                                            • Part of subcall function 6A6405C0: ?freeTree@QMapDataBase@@QAEXPAUQMapNodeBase@@H@Z.QT5CORE(?,00000004,?,?,?,6A63E210), ref: 6A640628
                                            • Part of subcall function 6A6405C0: ?freeData@QMapDataBase@@SAXPAU1@@Z.QT5CORE(?,?,?,?,6A63E210), ref: 6A64062F
                                            • Part of subcall function 6A640930: ?qstrcmp@@YAHABVQByteArray@@0@Z.QT5CORE(?,?,?,?,?,?,6A63E21C,?), ref: 6A64094C
                                            • Part of subcall function 6A640930: ?qstrcmp@@YAHABVQByteArray@@0@Z.QT5CORE(?,0000000C), ref: 6A64096C
                                          • ??0QString@@QAE@XZ.QT5CORE(?,?,?), ref: 6A63E22A
                                          • ?qstrcmp@@YAHABVQByteArray@@0@Z.QT5CORE(?,?), ref: 6A63E25D
                                          • ?qstrcmp@@YAHABVQByteArray@@0@Z.QT5CORE(?,0000000C), ref: 6A63E287
                                          • ??4QByteArray@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A63E297
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A63E2A1
                                          • ?createNode@QMapDataBase@@QAEPAUQMapNodeBase@@HHPAU2@_N@Z.QT5CORE(00000014,00000004,?,00000001), ref: 6A63E2C7
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,00000001), ref: 6A63E2D3
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,00000001), ref: 6A63E2E0
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,00000001), ref: 6A63E2EA
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$Base@@$Array@@$?qstrcmp@@Array@@0@Data$NodeV0@@$?create?freeData@U1@@$?setNode@Parent@String@@Tree@U2@_
                                          • String ID:
                                          • API String ID: 775543205-0
                                          • Opcode ID: bc07b1c6b8f8386260a0bc727e8edb5b67cc31fd84fcfc42a1cf13de175ffecd
                                          • Instruction ID: 95423c4a735ab05cff0c537446ce622c490c588ba4de24afb266f95d46d5c4a6
                                          • Opcode Fuzzy Hash: bc07b1c6b8f8386260a0bc727e8edb5b67cc31fd84fcfc42a1cf13de175ffecd
                                          • Instruction Fuzzy Hash: 8631AD725043128BD714DF65D844AAAB7F8FF89318F06891DED9683241EB31FD09CBA6
                                          Function 6A69C8E0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 118COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?lock@QMutex@@QAEXXZ.QT5CORE(?,6A6AF99D,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6A69C8FC
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE(?,?,?,?,?,6A6AF99D,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6A69CA40
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?lock@?unlock@Locker@@MutexMutex@@
                                          • String ID: p/pj$p/pj$p/pj$p/pj$p/pj
                                          • API String ID: 914300419-3225816790
                                          • Opcode ID: e80a57058714a94358624afaf18f7f05697b68ea9e7c85c99d3a48b63313eb3e
                                          • Instruction ID: 7af99ad861480ff57559b417ceb54db9331999ee21a916a64b829882682b82f8
                                          • Opcode Fuzzy Hash: e80a57058714a94358624afaf18f7f05697b68ea9e7c85c99d3a48b63313eb3e
                                          • Instruction Fuzzy Hash: 034180726007028FC714DF74C89492BBBE2BF85618B06495DE5A75B391EF30F809CB96
                                          Function 6A62C960 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(00000001,00000001), ref: 6A62C9A4
                                          • memmove.VCRUNTIME140(?,?,?), ref: 6A62C9E5
                                          • memmove.VCRUNTIME140(?,?,00000000), ref: 6A62CA1F
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000), ref: 6A62CA42
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?,00000000,?,6A62ACCE,00000000), ref: 6A62CA60
                                          • ?singleShot@QTimer@@SAXHPBVQObject@@PBD@Z.QT5CORE(00000000,00000005,1_q_startNextCommand(),?,00000000,?,6A62ACCE,00000000), ref: 6A62CA83
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@List$memmove$?append@?detach_grow@?dispose@?singleData@1@Data@1@@Object@@Shot@Timer@@
                                          • String ID: 1_q_startNextCommand()
                                          • API String ID: 3301838822-4160172084
                                          • Opcode ID: f2be85cdc587025687c686a15dfa18691e2ae22935b0ea6def4b525391425017
                                          • Instruction ID: 82ddbb841cc0da65a4f7b1bf2d9ad1591df0d149e75e37b3cd94575ad43c454e
                                          • Opcode Fuzzy Hash: f2be85cdc587025687c686a15dfa18691e2ae22935b0ea6def4b525391425017
                                          • Instruction Fuzzy Hash: 9041B3756002069FD710CF58D880A5977B5FF85358F198628E91ACB351DB32FD1ACF91
                                          Function 6A63CBA0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?serverError@QTcpServer@@QBE?AW4SocketError@QAbstractSocket@@XZ.QT5NETWORK(?,?,?,?,?,?,6BB48650,?), ref: 6A63CBAA
                                          • ?compare@QByteArray@@QBEHPBDW4CaseSensitivity@Qt@@@Z.QT5CORE(upgrade,00000000,?,?,?,6BB48650,?), ref: 6A63CBEB
                                          • ?compare@QByteArray@@QBEHPBDW4CaseSensitivity@Qt@@@Z.QT5CORE(h2c,00000000,?,?,?,6BB48650,?), ref: 6A63CBFE
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,-00000004,?,?,?,?,6BB48650,?), ref: 6A63CC52
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,-00000004,?,?,?,?,6BB48650,?), ref: 6A63CCA5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?compare@?dispose@Array@@ByteCaseData@1@@Data@@Error@ListQt@@@Sensitivity@$?serverAbstractServer@@SocketSocket@@
                                          • String ID: h2c$upgrade
                                          • API String ID: 3357064263-3746491965
                                          • Opcode ID: 366a5483a9e905e68ca11dcea15c70e96b66bfc5a96bead26514c3a74a0d5389
                                          • Instruction ID: 075b35d22e3610c58db51cb18848e8dcef6b643502978f4a6922081468519e18
                                          • Opcode Fuzzy Hash: 366a5483a9e905e68ca11dcea15c70e96b66bfc5a96bead26514c3a74a0d5389
                                          • Instruction Fuzzy Hash: D93181755046219FDB10DF59C880A5AB3E8EF85338B168519F8BBD7290DB30F81ACBA5
                                          Function 6A640B90 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 94COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?translate@QCoreApplication@@SA?AVQString@@PBD00H@Z.QT5CORE(?,QHttp,Connection closed,00000000,000000FF), ref: 6A640BB3
                                            • Part of subcall function 6A640450: ?detach_helper@QHashData@@QAEPAU1@P6AXPAUNode@1@PAX@ZP6AX0@ZHH@Z.QT5CORE(6A640650,6A6403B0,0000002C,00000004,?,6BC7ECD0,6A641B3B,?,6BC7ECD0,?,?,6A640128,?,?,?), ref: 6A640472
                                            • Part of subcall function 6A640450: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A6403B0,?,6BC7ECD0,?,?,6A640128,?,?,?), ref: 6A64049F
                                          • ?nextNode@QHashData@@SAPAUNode@1@PAU21@@Z.QT5CORE(?,?,00000002,?), ref: 6A640C0B
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(Function_000303B0), ref: 6A640C4E
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(Function_000303B0), ref: 6A640C72
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A640C7F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@Hash$?free_helper@Node@1@@$Node@1@String@@$?detach_helper@?next?translate@Application@@CoreNode@U21@@
                                          • String ID: Connection closed$QHttp
                                          • API String ID: 1349830208-3572436373
                                          • Opcode ID: 5327145549c384f285dc9c5d3f1ab14f693e98f2bdc647889d686cf6f43f5de1
                                          • Instruction ID: 116efd7275d4baa72386e696891663d59757f36b37bd26bbccd5edb65d213d15
                                          • Opcode Fuzzy Hash: 5327145549c384f285dc9c5d3f1ab14f693e98f2bdc647889d686cf6f43f5de1
                                          • Instruction Fuzzy Hash: E9310075204726CBDF10DF58C880A99B3B4EF51228F038258E82ACB281EF38EC45CB91
                                          Function 6A684290 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46networkwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QNetworkProxyQuery@@QAE@XZ.QT5NETWORK ref: 6A68429C
                                          • ?isValid@QAbstractSocket@@QBE_NXZ.QT5NETWORK ref: 6A6842A8
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A6842BB
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QUdpSocket::joinMulticastGroup() called on a QUdpSocket when not in QUdpSocket::BoundState), ref: 6A6842C7
                                          • ??1QNetworkInterface@@QAE@XZ.QT5NETWORK ref: 6A6842D6
                                          • ??1QNetworkInterface@@QAE@XZ.QT5NETWORK ref: 6A6842FE
                                          Strings
                                          • QUdpSocket::joinMulticastGroup() called on a QUdpSocket when not in QUdpSocket::BoundState, xrefs: 6A6842C1
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Network$Interface@@Logger@@Message$?warning@AbstractProxyQuery@@Socket@@Valid@
                                          • String ID: QUdpSocket::joinMulticastGroup() called on a QUdpSocket when not in QUdpSocket::BoundState
                                          • API String ID: 1958979349-868601650
                                          • Opcode ID: 1fe261278b0c0cfbaa71ef33ff30bc49342047823e222ea3bc9af282dadb88a8
                                          • Instruction ID: 3481d7135f22b2d75cf097943577476c60e85120e643f4698bf7bcda3fe3da02
                                          • Opcode Fuzzy Hash: 1fe261278b0c0cfbaa71ef33ff30bc49342047823e222ea3bc9af282dadb88a8
                                          • Instruction Fuzzy Hash: 8101FE766401006FCB00EB14DC54FCA73E4DF99314F05541AF952D7252DE75A80DC7B6
                                          Function 6A684360 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46networkwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QNetworkProxyQuery@@QAE@XZ.QT5NETWORK ref: 6A68436C
                                          • ?isValid@QAbstractSocket@@QBE_NXZ.QT5NETWORK ref: 6A684375
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A684388
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QUdpSocket::leaveMulticastGroup() called on a QUdpSocket when not in QUdpSocket::BoundState), ref: 6A684394
                                          • ??1QNetworkInterface@@QAE@XZ.QT5NETWORK ref: 6A6843A3
                                          • ??1QNetworkInterface@@QAE@XZ.QT5NETWORK ref: 6A6843CE
                                          Strings
                                          • QUdpSocket::leaveMulticastGroup() called on a QUdpSocket when not in QUdpSocket::BoundState, xrefs: 6A68438E
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Network$Interface@@Logger@@Message$?warning@AbstractProxyQuery@@Socket@@Valid@
                                          • String ID: QUdpSocket::leaveMulticastGroup() called on a QUdpSocket when not in QUdpSocket::BoundState
                                          • API String ID: 1958979349-2614186080
                                          • Opcode ID: c2c7e7ee5d675ff8bb3bae133b678cf021354c019dd33c3d5f1b4bba18b84257
                                          • Instruction ID: 0956e8843346ae40f00607a3e38938e9c11f652cd6a8b8789efbbd13e4feb7ea
                                          • Opcode Fuzzy Hash: c2c7e7ee5d675ff8bb3bae133b678cf021354c019dd33c3d5f1b4bba18b84257
                                          • Instruction Fuzzy Hash: 3A012636280200AFCA00EB18CC54FCA73E8DF95210F05541BEA52C7251DE35A80DCBB6
                                          Function 6A67C070 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 43windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A67C083
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000), ref: 6A67C0B9
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,stopMonitoring was called when not monitoring!), ref: 6A67C0C5
                                          • ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.monitor), ref: 6A67C0FA
                                          • __Init_thread_footer.LIBCMT ref: 6A67C10F
                                          Strings
                                          • stopMonitoring was called when not monitoring!, xrefs: 6A67C0BF
                                          • qt.network.monitor, xrefs: 6A67C0F0
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: qt.network.monitor$stopMonitoring was called when not monitoring!
                                          • API String ID: 646154281-3392769747
                                          • Opcode ID: d60cb791c64fa3ba5042365c7a053972a74a900f862f6349923d3212a2def604
                                          • Instruction ID: abb0001bb87ac92b3a72bb585dd135cbe7834f14a9573004dc4521a517d090b1
                                          • Opcode Fuzzy Hash: d60cb791c64fa3ba5042365c7a053972a74a900f862f6349923d3212a2def604
                                          • Instruction Fuzzy Hash: 1A0175F6A401009BDF20ABB4CD5DB1937B5E747309F5601A8E61786282EF33F915CBA6
                                          Function 6A6B0BE0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 31COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Error during SSL handshake: %1,00000000,000000FF), ref: 6A6B0BF7
                                            • Part of subcall function 6A6AFF10: ??0QString@@QAE@XZ.QT5CORE ref: 6A6AFF2F
                                            • Part of subcall function 6A6AFF10: memset.VCRUNTIME140(?,00000000,00000100), ref: 6A6AFF41
                                            • Part of subcall function 6A6AFF10: ?append@QString@@QAEAAV1@VQLatin1String@@@Z.QT5CORE(00000002,6A6C26C8), ref: 6A6AFF73
                                            • Part of subcall function 6A6AFF10: ?fromLatin1@QString@@SA?AV1@PBDH@Z.QT5CORE(?,?,000000FF,00000000,?,00000100), ref: 6A6AFF91
                                            • Part of subcall function 6A6AFF10: ?append@QString@@QAEAAV1@ABV1@@Z.QT5CORE(00000000), ref: 6A6AFF9D
                                            • Part of subcall function 6A6AFF10: ??1QString@@QAE@XZ.QT5CORE ref: 6A6AFFA3
                                          • ??0QChar@@QAE@UQLatin1Char@@@Z.QT5CORE(00000020), ref: 6A6B0C14
                                          • ?arg@QString@@QBE?AV1@ABV1@HVQChar@@@Z.QT5CORE(?,00000000,00000000), ref: 6A6B0C26
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6B0C30
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6B0C3A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$?append@Char@@@Latin1$?arg@?from?tr@Char@@Latin1@MetaObject@@String@@@V1@@memset
                                          • String ID: $Error during SSL handshake: %1
                                          • API String ID: 2613909222-350737321
                                          • Opcode ID: 0e9549bef03e0d1f42b05022dcb2f9b182c5e36126406f6fda20317293c524cd
                                          • Instruction ID: 02097db16710c9d20e10b4844d97981f618e1161786c8cb2f0d88a5e005433a9
                                          • Opcode Fuzzy Hash: 0e9549bef03e0d1f42b05022dcb2f9b182c5e36126406f6fda20317293c524cd
                                          • Instruction Fuzzy Hash: 9EF01D70508352ABCB00EB65D818B9B7BF8EF46625F014919F55AD3291DB74AD08CB92
                                          Function 6A678B90 Relevance: 12.1, APIs: 8, Instructions: 118COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(00000001,00000001,6BB208B0,?), ref: 6A678BD4
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A678C03
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A678C43
                                          • ??1QDnsDomainNameRecord@@QAE@XZ.QT5NETWORK ref: 6A678C86
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000), ref: 6A678C90
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,?,?,?,6A679546,?), ref: 6A678CB0
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,?,?,?,6A679546,?), ref: 6A678CC7
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?,?,?,?,6A679546,?), ref: 6A678CCE
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Authenticator@@SharedV0@@$Data@@List$?append@?detach_grow@?dispose@Data@1@Data@1@@DomainNameRecord@@
                                          • String ID:
                                          • API String ID: 1852344941-0
                                          • Opcode ID: de9617e88f4f473c60f99d4051d004c04430c3f57f8bd38a4b86fb0ca93b5527
                                          • Instruction ID: 0528bbb2a72528c27150d7dca287111ed7d4ae6132adeca83302554b0e56a759
                                          • Opcode Fuzzy Hash: de9617e88f4f473c60f99d4051d004c04430c3f57f8bd38a4b86fb0ca93b5527
                                          • Instruction Fuzzy Hash: 8141D9769042158FCB14DF08C880959B7F1FF80318B16456DED1A67352DB31FD5ACB95
                                          Function 6A64E350 Relevance: 12.1, APIs: 8, Instructions: 117COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(00000001,00000001,15FF1420,4C8D6A68), ref: 6A64E394
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(4C8D6A68), ref: 6A64E3C3
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(4C8D6A68), ref: 6A64E403
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A64E447
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000), ref: 6A64E452
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A64E72F,-00000004), ref: 6A64E472
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A64E72F,-00000004), ref: 6A64E48A
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,6A64E72F,-00000004), ref: 6A64E492
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$V0@@$Data@@List$?append@?detach_grow@?dispose@Data@1@Data@1@@
                                          • String ID:
                                          • API String ID: 3083179296-0
                                          • Opcode ID: b0178b5cc080f5f3abaab016492e2b1ae2b0f56d0727b3f851aa0646e5506da2
                                          • Instruction ID: 878315bfee23985e17edefbcaf92b0aa8c51a5ba1760abe34c94c4f39362108f
                                          • Opcode Fuzzy Hash: b0178b5cc080f5f3abaab016492e2b1ae2b0f56d0727b3f851aa0646e5506da2
                                          • Instruction Fuzzy Hash: 2D41A3766042158FCB00DF08C880999B7F1FF85318B1A856CE96AA7391DB31FD1ACB95
                                          Function 6A614840 Relevance: 12.1, APIs: 8, Instructions: 117networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(00000001,00000001), ref: 6A614882
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK ref: 6A6148B3
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK ref: 6A6148F3
                                          • ??1QNetworkCookie@@QAE@XZ.QT5NETWORK ref: 6A614936
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000), ref: 6A614940
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A614960
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A614975
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?), ref: 6A61497C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Authenticator@@SharedV0@@$Data@@List$?append@?detach_grow@?dispose@Cookie@@Data@1@Data@1@@Network
                                          • String ID:
                                          • API String ID: 3080320601-0
                                          • Opcode ID: f81d35c4f9578f73f39dfdce9bec2a5a95ef41178bd62bbf01e1ff133835ceb2
                                          • Instruction ID: 0f629b8e31ca221e0c0a7e613dc4e7811f84bff4349b9d17960f0ecadf21eab2
                                          • Opcode Fuzzy Hash: f81d35c4f9578f73f39dfdce9bec2a5a95ef41178bd62bbf01e1ff133835ceb2
                                          • Instruction Fuzzy Hash: 0641E6B6A042158FCB00DF1CC88495977B1FF80318B1A456CED6A67352DB31FD1ACB81
                                          Function 6A638140 Relevance: 12.1, APIs: 8, Instructions: 89COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QString@@QAE@XZ.QT5CORE(?), ref: 6A63816C
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?), ref: 6A638197
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(00000000,?), ref: 6A6381C0
                                          • ??0QString@@QAE@XZ.QT5CORE(00000000,?), ref: 6A6381D5
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?), ref: 6A638206
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A638210
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$String@@
                                          • String ID:
                                          • API String ID: 554220883-0
                                          • Opcode ID: 729c78d145aa454de33c895bb6035d8de59e928916d3d41113dd17f2fd36c171
                                          • Instruction ID: 0b6c79af1bf9ff64eb9feb20dff7decd9fdb048abfde0f4cdefab18528750d1a
                                          • Opcode Fuzzy Hash: 729c78d145aa454de33c895bb6035d8de59e928916d3d41113dd17f2fd36c171
                                          • Instruction Fuzzy Hash: 56218E752442129FCB04EF10E858ADFB7E8FF95214F41942AE8A2C3150DF35A90FCBA2
                                          Function 6A612840 Relevance: 10.6, APIs: 7, Instructions: 132memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?allocate@QArrayData@@SAPAU1@IIIV?$QFlags@W4AllocationOption@QArrayData@@@@@Z.QT5CORE(0000000C,00000004,?,?,0000000C), ref: 6A612870
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(0000000C,?,?,?,?,6BB6B980,00000000,00000000,6A6119FD,?), ref: 6A6128BE
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000010,?,?,?,?,6BB6B980,00000000,00000000,6A6119FD,?), ref: 6A6128CB
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000014,?,?,?,?,6BB6B980,00000000,00000000,6A6119FD,?), ref: 6A6128D8
                                          • memmove.VCRUNTIME140(?,0000000C,?,?,?,?,?,6BB6B980,00000000,00000000,6A6119FD,?), ref: 6A612909
                                          • ?deallocate@QArrayData@@SAXPAU1@II@Z.QT5CORE(0000000C,0000000C,00000004), ref: 6A612956
                                          • ?deallocate@QArrayData@@SAXPAU1@II@Z.QT5CORE(0000000C,0000000C,00000004,?,?), ref: 6A61298B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array$Array@@ByteData@@V0@@$?deallocate@$?allocate@AllocationData@@@@@Flags@Option@memmove
                                          • String ID:
                                          • API String ID: 2232635392-0
                                          • Opcode ID: 3de5460ee96162eda6a01113577d97078a69fe2a36b9bc16712ff6b8599018cb
                                          • Instruction ID: b37dc8baf948439952c1e0192f70d1ea6fa5a0c01d55ddd29de642c5563ea6a6
                                          • Opcode Fuzzy Hash: 3de5460ee96162eda6a01113577d97078a69fe2a36b9bc16712ff6b8599018cb
                                          • Instruction Fuzzy Hash: 6641A0752042019FC710CF2EC8C0B56BBF5FF86328F0546A9E5598B2A1DB32ED1ACB95
                                          Function 6A646260 Relevance: 10.6, APIs: 7, Instructions: 111networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??1QNetworkProxy@@QAE@XZ.QT5NETWORK(?,?,?,000000FF,0000006C), ref: 6A64626B
                                            • Part of subcall function 6A672130: ??1QString@@QAE@XZ.QT5CORE(?,6A61368A), ref: 6A672151
                                            • Part of subcall function 6A672130: ??1QString@@QAE@XZ.QT5CORE ref: 6A67215A
                                            • Part of subcall function 6A672130: ??1QString@@QAE@XZ.QT5CORE ref: 6A672163
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,000000FF,0000006C), ref: 6A64629B
                                          • ??1QSslConfiguration@@QAE@XZ.QT5NETWORK(?,?,?,?,000000FF,0000006C), ref: 6A6462F9
                                          • ?freeTree@QMapDataBase@@QAEXPAUQMapNodeBase@@H@Z.QT5CORE(?,00000004,?,?,?,?,000000FF,0000006C), ref: 6A64635C
                                          • ?freeData@QMapDataBase@@SAXPAU1@@Z.QT5CORE(?,?,?,?,?,000000FF,0000006C), ref: 6A646363
                                          • ??1QAuthenticator@@QAE@XZ.QT5NETWORK ref: 6A64637C
                                          • ??1QAuthenticator@@QAE@XZ.QT5NETWORK ref: 6A646384
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Base@@String@@$?freeAuthenticator@@Data$Array@@ByteConfiguration@@Data@NetworkNodeProxy@@Tree@U1@@
                                          • String ID:
                                          • API String ID: 2010682717-0
                                          • Opcode ID: 66ce55692760767428a94575c10da441bfc59a0fb6ac3d59883b39d822f2f605
                                          • Instruction ID: 4bafb03d8bb8c811d65222827a29292eb9b561f92cbc6396b9b42f2d75627444
                                          • Opcode Fuzzy Hash: 66ce55692760767428a94575c10da441bfc59a0fb6ac3d59883b39d822f2f605
                                          • Instruction Fuzzy Hash: 5141DD343006419BEB15DFA4C894A6AB3B5FF41728B16862CD567CB691EF20F80ACB81
                                          Function 6A638250 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109COMMON
                                          Download Yara Rule
                                          Strings
                                          • failed to prepend a new field, xrefs: 6A638319
                                          • invalid bit offset, xrefs: 6A6382E1
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$V0@@
                                          • String ID: failed to prepend a new field$invalid bit offset
                                          • API String ID: 2425253710-3415108434
                                          • Opcode ID: 2b8767cc8bbafb6e42c5023fb43330e15c3447277efe37894296e65774bf40ad
                                          • Instruction ID: 8c4c9ea956480cfb7ebfda7190d492b151dfa71721bd77c2ccff3f73ee5f38df
                                          • Opcode Fuzzy Hash: 2b8767cc8bbafb6e42c5023fb43330e15c3447277efe37894296e65774bf40ad
                                          • Instruction Fuzzy Hash: BD2128773802243BD60476559C54FEFB7A9EBE1625F01502EFE0296282DF66680A83F6
                                          Function 6A6500A0 Relevance: 10.6, APIs: 7, Instructions: 99COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A650110
                                          • ?resize@QByteArray@@QAEXH@Z.QT5CORE(?), ref: 6A650121
                                          • ?begin@QByteArray@@QAEPADXZ.QT5CORE ref: 6A650127
                                          • ?read@QIODevice@@QAE_JPAD_J@Z.QT5CORE(00000000,?,?), ref: 6A650134
                                          • ?clear@QByteArray@@QAEXXZ.QT5CORE ref: 6A650149
                                          • ?resize@QByteArray@@QAEXH@Z.QT5CORE(00000000), ref: 6A650163
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?), ref: 6A650198
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?resize@$?begin@?clear@?read@Device@@String@@
                                          • String ID:
                                          • API String ID: 2008597839-0
                                          • Opcode ID: a231d18ba04ee04d13b9f9dabe3d14951ad98b6d46a67f617089b22a2b92863f
                                          • Instruction ID: 3dab279a669f51f590cd1035c1b8725ea122154e8c4ba08251db306f7bd90f26
                                          • Opcode Fuzzy Hash: a231d18ba04ee04d13b9f9dabe3d14951ad98b6d46a67f617089b22a2b92863f
                                          • Instruction Fuzzy Hash: E33148726047018FC314DEA9D88095AB3F6BBC9318F16492EE596C3351EB70F959CB62
                                          Function 6A67A950 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90memorywindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FormatMessageW.KERNEL32 ref: 6A67A98A
                                          • LocalAlloc.KERNEL32(00000000,00000040), ref: 6A67A9E0
                                          • ?fromWCharArray@QString@@SA?AV1@PB_WH@Z.QT5CORE(?,00000000,000000FF), ref: 6A67AA37
                                          • LocalFree.KERNEL32(?), ref: 6A67AA5F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Local$?fromAllocArray@CharFormatFreeMessageString@@
                                          • String ID: IDispatch error #%d$Unknown error 0x%0lX
                                          • API String ID: 350983163-2934499512
                                          • Opcode ID: f48620da7cbd815cb674afddc60b332bcfbe989a6ac5b9a7bf7c08e2c698d750
                                          • Instruction ID: ff5fc775312230f1d211d59d27822ebca2cabed273b95628045599332cadd9b8
                                          • Opcode Fuzzy Hash: f48620da7cbd815cb674afddc60b332bcfbe989a6ac5b9a7bf7c08e2c698d750
                                          • Instruction Fuzzy Hash: 6831CD74614302AFE714CF68C819B6AB2F4FF94304F11841CF666972D1EB30E955CB9A
                                          Function 6A6662B0 Relevance: 10.6, APIs: 7, Instructions: 75COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@HW4Initialization@Qt@@@Z.QT5CORE(00000002,00000000,00000000,?,6BB4C360,?), ref: 6A6662DE
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A6662E6
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A6662FC
                                          • ?cend@QByteArray@@QBEPBDXZ.QT5CORE ref: 6A666306
                                          • ?data@QString@@QBEPBVQChar@@XZ.QT5CORE ref: 6A66632F
                                          • ?cend@QByteArray@@QBEPBDXZ.QT5CORE ref: 6A666339
                                          • ?resize@QByteArray@@QAEXH@Z.QT5CORE(?), ref: 6A66635A
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?data@Char@@String@@$?cend@$?resize@Initialization@Qt@@@
                                          • String ID:
                                          • API String ID: 3111387403-0
                                          • Opcode ID: 3c619e29cb75d8ae2beb31e88cf4451cc499d66b189431d4030fd5af76a9f243
                                          • Instruction ID: 2ddb4ddf1c6dacfad07df9ca9dfdcf1ae65ad278200132f6cec3f92989846440
                                          • Opcode Fuzzy Hash: 3c619e29cb75d8ae2beb31e88cf4451cc499d66b189431d4030fd5af76a9f243
                                          • Instruction Fuzzy Hash: 482125783043518FCB04CF69D19862AFBF6FB8E201B15466AE896D7311DB74BC49CB92
                                          Function 6A6248A0 Relevance: 10.6, APIs: 7, Instructions: 71timenetworkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isValid@QElapsedTimer@@QBE_NXZ.QT5CORE(?,?,?,?,?,6A61A8B1,?,?,?,?), ref: 6A6248D1
                                          • ?elapsed@QElapsedTimer@@QBE_JXZ.QT5CORE(?,?,?,?,?,6A61A8B1,?,?,?,?), ref: 6A6248ED
                                          • ?restart@QElapsedTimer@@QAE_JXZ.QT5CORE(?,?,?,?,?,6A61A8B1,?,?,?,?), ref: 6A624915
                                          • ?start@QElapsedTimer@@QAEXXZ.QT5CORE(?,?,?,?,?,6A61A8B1,?,?,?,?), ref: 6A624923
                                          • ?uploadProgress@QNetworkReply@@QAEX_J0@Z.QT5NETWORK(?,?,?,?,?,?,?,?,?,6A61A8B1,?,?,?,?), ref: 6A62493E
                                          • ??0QEvent@@QAE@W4Type@0@@Z.QT5CORE(000000B9), ref: 6A624974
                                          • ?postEvent@QCoreApplication@@SAXPAVQObject@@PAVQEvent@@H@Z.QT5CORE(?,00000000,00000000), ref: 6A624984
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ElapsedTimer@@$Event@@$?elapsed@?post?restart@?start@?uploadApplication@@CoreEvent@NetworkObject@@Progress@Reply@@Type@0@@Valid@
                                          • String ID:
                                          • API String ID: 2667984735-0
                                          • Opcode ID: a2a6f640ffa3af3fb4146734f69462e5921820a117383da0e3bb56babfff7338
                                          • Instruction ID: 11e0fa9f4fbffd9631cec691de62c6e9784660d4d38b2be08e4eedfe45f9015c
                                          • Opcode Fuzzy Hash: a2a6f640ffa3af3fb4146734f69462e5921820a117383da0e3bb56babfff7338
                                          • Instruction Fuzzy Hash: 942146715443009BE720CF69C888B9BBBF4BF59254F014A1DE59B92281DBB1A944CF62
                                          Function 6A622370 Relevance: 10.6, APIs: 7, Instructions: 65networkCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QIODevicePrivate@@QAE@XZ.QT5CORE ref: 6A622388
                                          • ??0QNetworkRequest@@QAE@XZ.QT5NETWORK ref: 6A6223D2
                                            • Part of subcall function 6A61F860: ??0QMutex@@QAE@XZ.QT5CORE ref: 6A61F872
                                            • Part of subcall function 6A61F860: ??0QMutex@@QAE@XZ.QT5CORE ref: 6A61F8A4
                                            • Part of subcall function 6A61F860: ??0QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,6A6115F7,00000000), ref: 6A61F8C2
                                            • Part of subcall function 6A61F860: ??0QHttp2Configuration@@QAE@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,6A6115F7,00000000), ref: 6A61F8CB
                                            • Part of subcall function 6A61F860: ?setStreamReceiveWindowSize@QHttp2Configuration@@QAE_NI@Z.QT5NETWORK(0147AE14,?,?,?,?,?,?,?,?,?,?,?,6A6115F7,00000000), ref: 6A61F8FF
                                            • Part of subcall function 6A61F860: ?setSessionReceiveWindowSize@QHttp2Configuration@@QAE_NI@Z.QT5NETWORK(7FFFFFFF,0147AE14,?,?,?,?,?,?,?,?,?,?,?,6A6115F7,00000000), ref: 6A61F922
                                            • Part of subcall function 6A61F860: ?setServerPushEnabled@QHttp2Configuration@@QAEX_N@Z.QT5NETWORK(00000000,7FFFFFFF,0147AE14,?,?,?,?,?,?,?,?,?,?,?,6A6115F7,00000000), ref: 6A61F942
                                          • ??0QNetworkRequest@@QAE@XZ.QT5NETWORK ref: 6A6223DD
                                          • ??0QMutex@@QAE@XZ.QT5CORE ref: 6A6223E8
                                          • ??0QVariant@@QAE@_N@Z.QT5CORE ref: 6A62248E
                                            • Part of subcall function 6A620850: ?rehash@QHashData@@QAEXH@Z.QT5CORE(?,?,?,?,00000000,?,?,6A6224B6,?,?,?), ref: 6A620888
                                            • Part of subcall function 6A620850: ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000008,?,?,?,00000000,?,?,6A6224B6,?,?,?), ref: 6A6208A2
                                            • Part of subcall function 6A620850: ??0QVariant@@QAE@ABV0@@Z.QT5CORE(?,?,00000000,?,?,6A6224B6,?,?,?), ref: 6A6208C2
                                          • ??1QVariant@@QAE@XZ.QT5CORE(?,?,?), ref: 6A6224BA
                                          • ??0QNetworkReply@@IAE@AAVQNetworkReplyPrivate@@PAVQObject@@@Z.QT5NETWORK(00000000,?), ref: 6A6224C7
                                            • Part of subcall function 6A6222F0: ??0QIODevice@@IAE@AAVQIODevicePrivate@@PAVQObject@@@Z.QT5CORE(?,?,00000000,?,6A6224CC,00000000,?), ref: 6A6222FC
                                            • Part of subcall function 6A6222F0: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PBV1@PAPAX01PAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PBHPBU3@@Z.QT5CORE(?,?,?,?,?,00000000,00000000,00000000,?,0000000C,?,6A6224CC,00000000,?), ref: 6A62234E
                                            • Part of subcall function 6A6222F0: ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A62235B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Configuration@@Http2NetworkPrivate@@$?setMutex@@Object@@Variant@@$Connection@Data@@DeviceHashMetaObject@@@ReceiveRequest@@Size@Window$?allocate?connect?rehash@Base@ConnectionDevice@@Enabled@Impl@Node@ObjectPushQt@@ReplyReply@@ServerSessionSlotStreamString@@Type@U3@@V0@@malloc
                                          • String ID:
                                          • API String ID: 1275026668-0
                                          • Opcode ID: 471f54684e875cbcd0e8a36c25e4ed6b473ac86b9fc3951f993969f5ccd0d5ee
                                          • Instruction ID: 17911b2663841fddfc2dfda0f00fac2f09005027bc998af82b671f4bd2161c2f
                                          • Opcode Fuzzy Hash: 471f54684e875cbcd0e8a36c25e4ed6b473ac86b9fc3951f993969f5ccd0d5ee
                                          • Instruction Fuzzy Hash: 2931C2B4104B418BE324DF25C468B87BBF5FB85304F11891DE5AB8B281DBB96508CFA6
                                          Function 6A6AA2D0 Relevance: 10.6, APIs: 7, Instructions: 61COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QSharedData@@QAE@ABV0@@Z.QT5CORE(?,00000000), ref: 6A6AA2FB
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A6AA308
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A6AA315
                                          • ??0QVariant@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A6AA322
                                          • ??1QVariant@@QAE@XZ.QT5CORE ref: 6A6AA34D
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6AA356
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6AA35F
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: V0@@$Array@@ByteString@@Variant@@$Data@@Sharedmalloc
                                          • String ID:
                                          • API String ID: 141030773-0
                                          • Opcode ID: 59b6e9174bfb86645c004114be7f71a48e04bb09da7c4821501f63b1af1ba637
                                          • Instruction ID: 0cdbf65e19bdf7ee0b8afad66845caf4641264ac545407e9beb3e09f139b5ac5
                                          • Opcode Fuzzy Hash: 59b6e9174bfb86645c004114be7f71a48e04bb09da7c4821501f63b1af1ba637
                                          • Instruction Fuzzy Hash: 5C118B71101602CFDB51CF69C8989AABBF4FF16215306026AE95BCB295DF30FD59CB50
                                          Function 6A62CB90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(00000006,QUIT), ref: 6A62CBAF
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,7FFFFFFF,00000001), ref: 6A62CBE1
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A62CBF2
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE ref: 6A62CBFC
                                          • ??1QString@@QAE@XZ.QT5CORE(00000000), ref: 6A62CC4F
                                            • Part of subcall function 6A62D2A0: ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(?,?,?,00000000,?,?,6A62AC68,7FFFFFFF,00000001), ref: 6A62D2C5
                                            • Part of subcall function 6A62D2A0: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,00000000,?,?,6A62AC68,7FFFFFFF,00000001), ref: 6A62D2F3
                                            • Part of subcall function 6A62D2A0: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,00000000,?,?,6A62AC68,7FFFFFFF,00000001), ref: 6A62D343
                                            • Part of subcall function 6A62D2A0: ??1QString@@QAE@XZ.QT5CORE(?,00000000,?,?,6A62AC68,7FFFFFFF,00000001), ref: 6A62D387
                                            • Part of subcall function 6A62D2A0: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,?,00000000,?,?,6A62AC68,7FFFFFFF,00000001), ref: 6A62D392
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@ByteV0@@$Data@@ListString@@$?append@?detach_grow@?dispose@Data@1@Data@1@@Latin1String@@@malloc
                                          • String ID: QUIT
                                          • API String ID: 3315473051-1580285122
                                          • Opcode ID: f1a57ae5f459d4c5594e5f2a1bd872fe0390061936dbbc22b6ec7d784977f5b1
                                          • Instruction ID: dd22fa824cd2973ff7227cf1b03f6f2f38de634bad62653cc767fd958f63f537
                                          • Opcode Fuzzy Hash: f1a57ae5f459d4c5594e5f2a1bd872fe0390061936dbbc22b6ec7d784977f5b1
                                          • Instruction Fuzzy Hash: 83216AB55043019BD704DB25C858A9ABBF4AF96314F01892DE49BC32A0EF70E809CB92
                                          Function 6A652330 Relevance: 10.6, APIs: 7, Instructions: 54COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QUrl@@QAE@ABV0@@Z.QT5CORE(?,?,?,?,6A65DBEA,?,?,?), ref: 6A652363
                                          • ?path@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?), ref: 6A65237B
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A65238A
                                          • ?setPath@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z.QT5CORE(?), ref: 6A6523A7
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6523B1
                                          • ?toEncoded@QUrl@@QBE?AVQByteArray@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z.QT5CORE(?,01F00086), ref: 6A6523C9
                                          • ??1QUrl@@QAE@XZ.QT5CORE ref: 6A6523D3
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Url@@$String@@$Formatting$ComponentFlags@Option@$?path@?setArray@@ByteEncoded@Mode@1@@Option@2@@@@ParsingPath@Url@@@@@V0@@
                                          • String ID:
                                          • API String ID: 1928337760-0
                                          • Opcode ID: 72cbdedcbf7b95bf74a674bbee163a325046d24bc436e47112800c63e4d28ac1
                                          • Instruction ID: 9b88e85f92c67fcaff4fac7962b6cf0d6043a0d0e5113078c8328ffcb58124cd
                                          • Opcode Fuzzy Hash: 72cbdedcbf7b95bf74a674bbee163a325046d24bc436e47112800c63e4d28ac1
                                          • Instruction Fuzzy Hash: 28115EB6104211AFC705CF54C858A8ABBF8EF96356F01845DF88AD3191DB31ED0ACBD2
                                          Function 6A64E820 Relevance: 10.5, APIs: 7, Instructions: 45COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A64E830
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A64E83E
                                          • ?prepend@QListData@@QAEPAPAXXZ.QT5CORE ref: 6A64E860
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A64E87B
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A64E889
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A64E895
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A64E89F
                                            • Part of subcall function 6A64E600: ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(?,?), ref: 6A64E61E
                                            • Part of subcall function 6A64E600: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,?,?,?,?,00000000,?,?), ref: 6A64E6B3
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$V0@@$Data@@List$?detach_grow@?dispose@?prepend@Data@1@Data@1@@
                                          • String ID:
                                          • API String ID: 3144688528-0
                                          • Opcode ID: 888eeb9a4df755edcb559036aef0ddf84cfebcdb42f55d7f104de1ae547f2d20
                                          • Instruction ID: 0b099ab1ddb5b881ac7d235f94467038e051b1c046031e548bc09407ff3ff257
                                          • Opcode Fuzzy Hash: 888eeb9a4df755edcb559036aef0ddf84cfebcdb42f55d7f104de1ae547f2d20
                                          • Instruction Fuzzy Hash: 200129716042069FCF00DF21C858A9A7BB5FF92719F018829F58BC7190EF31A94ACB92
                                          Function 6A68C840 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43windownetworkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68C85D
                                            • Part of subcall function 6A68E600: getsockopt.WS2_32(?,00000000,00000009,?,?), ref: 6A68E63A
                                            • Part of subcall function 6A68E600: htonl.WS2_32(00000000), ref: 6A68E664
                                            • Part of subcall function 6A68E600: ??0QHostAddress@@QAE@I@Z.QT5NETWORK(00000000), ref: 6A68E66F
                                            • Part of subcall function 6A68E600: ?allInterfaces@QNetworkInterface@@SA?AV?$QList@VQNetworkInterface@@@@XZ.QT5NETWORK(00000000,00000000), ref: 6A68E679
                                            • Part of subcall function 6A68E600: ?flags@QNetworkInterface@@QBE?AV?$QFlags@W4InterfaceFlag@QNetworkInterface@@@@XZ.QT5NETWORK(?,?), ref: 6A68E6A6
                                            • Part of subcall function 6A68E600: ?addressEntries@QNetworkInterface@@QBE?AV?$QList@VQNetworkAddressEntry@@@@XZ.QT5NETWORK(?,?), ref: 6A68E6B7
                                            • Part of subcall function 6A68E600: ?ip@QNetworkAddressEntry@@QBE?AVQHostAddress@@XZ.QT5NETWORK(?,?,?), ref: 6A68E6DD
                                            • Part of subcall function 6A68E600: ??8QHostAddress@@QBE_NABV0@@Z.QT5NETWORK(?,?,?,?), ref: 6A68E6E9
                                            • Part of subcall function 6A68E600: ??1QHostAddress@@QAE@XZ.QT5NETWORK(?,?,?,?), ref: 6A68E6F4
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNativeSocketEngine::multicastInterface() was called by a socket other than QAbstractSocket::UdpSocket), ref: 6A68C869
                                          • ??0QNetworkProxyQuery@@QAE@XZ.QT5NETWORK ref: 6A68C876
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68C897
                                          Strings
                                          • QNativeSocketEngine::multicastInterface() was called on an uninitialized socket device, xrefs: 6A68C863
                                          • QNativeSocketEngine::multicastInterface() was called by a socket other than QAbstractSocket::UdpSocket, xrefs: 6A68C89D
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Network$Address@@Host$Interface@@Logger@@Message$AddressInterface@@@@List@$?address?all?flags@?ip@?warning@Entries@Entry@@Entry@@@@Flag@Flags@InterfaceInterfaces@ProxyQuery@@V0@@getsockopthtonl
                                          • String ID: QNativeSocketEngine::multicastInterface() was called by a socket other than QAbstractSocket::UdpSocket$QNativeSocketEngine::multicastInterface() was called on an uninitialized socket device
                                          • API String ID: 1840192112-2433251788
                                          • Opcode ID: 91202bd11d19cadf6113929f8564483021693c614a9c330b5b2d51f893a7f7de
                                          • Instruction ID: 6e36ecd95b6e0db481be65a8203563c82f58e604a66c91dcad4ac468bbac0c04
                                          • Opcode Fuzzy Hash: 91202bd11d19cadf6113929f8564483021693c614a9c330b5b2d51f893a7f7de
                                          • Instruction Fuzzy Hash: 4A01D1B1240200ABC614EA5ECC4AF8AB7B4FF96B19F150529F247A7190DF20F904C7BB
                                          Function 6A630270 Relevance: 10.5, APIs: 7, Instructions: 40timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A63027B
                                          • ?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ.QT5NETWORK ref: 6A630288
                                          • ?readAll@QIODevice@@QAE?AVQByteArray@@XZ.QT5CORE(?), ref: 6A63029A
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A6302A3
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6302AD
                                          • ??4QByteArray@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 6A6302CC
                                          • ?clear@QByteArray@@QAEXXZ.QT5CORE ref: 6A6302D4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$V0@@$?clear@?read?state@AbstractAll@DateDevice@@SocketSocket@@State@1@String@@Time@@V0@$$
                                          • String ID:
                                          • API String ID: 757289736-0
                                          • Opcode ID: 929cf555cb02d2217d755bbb5cb42ef0216c9e0483439140af36844077de9c63
                                          • Instruction ID: 7d4b06cf9dfb038483dfca11d99029f69c8db9995f4e3688d8f73c0f0b8efe62
                                          • Opcode Fuzzy Hash: 929cf555cb02d2217d755bbb5cb42ef0216c9e0483439140af36844077de9c63
                                          • Instruction Fuzzy Hash: 5D01FBBA7052119FCB44DB6AC45896EB7F5FFCA326B06841AE647C3310DB30AC06CB51
                                          Function 6A67E2F0 Relevance: 10.5, APIs: 7, Instructions: 36libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QString@@QAE@XZ.QT5CORE(771AFFC0,6A67C8DE,?,LookupAccountNameW,?,771AFFC0), ref: 6A67E2F8
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?,?,771AFFC0), ref: 6A67E306
                                          • ?utf16@QString@@QBEPBGXZ.QT5CORE ref: 6A67E31F
                                          • ?load@QSystemLibrary@@SAPAUHINSTANCE__@@PB_W_N@Z.QT5CORE(00000000), ref: 6A67E326
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A67E342
                                          • GetProcAddress.KERNEL32(00000000,?), ref: 6A67E354
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A67E360
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$?load@?utf16@AddressE__@@Library@@ProcSystemV0@@
                                          • String ID:
                                          • API String ID: 2277660958-0
                                          • Opcode ID: 7bf27ab181e7c61ced9f1d8783251dcf3ebaa830019d5d0515eedad4fbc88a31
                                          • Instruction ID: 5708d016fadbbaf222cf8a2775c734f0b5ea9d8e9b98023b2b1abe9922a32a2a
                                          • Opcode Fuzzy Hash: 7bf27ab181e7c61ced9f1d8783251dcf3ebaa830019d5d0515eedad4fbc88a31
                                          • Instruction Fuzzy Hash: A0012871508201AFDB00DB65D818B9ABFF0AF85656F458818F88BC2250EB35AA58CB83
                                          Function 6A622220 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 24timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QLocale@@QAE@W4Language@0@W4Country@0@@Z.QT5CORE(00000001,00000000,?,?), ref: 6A62222A
                                          • ?toString@QLocale@@QBE?AVQString@@ABVQDateTime@@VQStringView@@@Z.QT5CORE(?), ref: 6A62224F
                                          • ?toLatin1@QString@@QHAE?AVQByteArray@@XZ.QT5CORE(?), ref: 6A62225B
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A622265
                                          • ??1QLocale@@QAE@XZ.QT5CORE ref: 6A62226E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Locale@@String@@$Array@@ByteCountry@0@@DateLanguage@0@Latin1@StringString@Time@@View@@@
                                          • String ID: h(lj
                                          • API String ID: 3394434398-2376579909
                                          • Opcode ID: 495d472c58f4448ff0c634a8e99161a7565dc20dbb2eb4a89d299875b67eafdc
                                          • Instruction ID: b960f8efeea49b36e6a80674c6a2a2ec5c8be4c48443dbce004cd1add09b34be
                                          • Opcode Fuzzy Hash: 495d472c58f4448ff0c634a8e99161a7565dc20dbb2eb4a89d299875b67eafdc
                                          • Instruction Fuzzy Hash: C6F0D470504202AFDB04EF65C959A5DBBF0FB55702F41882CF89AC2291EB31AA19CB92
                                          Function 6A646B50 Relevance: 9.3, APIs: 6, Instructions: 265COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ.QT5NETWORK ref: 6A646C2B
                                          • ?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ.QT5NETWORK ref: 6A646CB0
                                          • ?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ.QT5NETWORK ref: 6A646DB0
                                          • ?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ.QT5NETWORK ref: 6A646E15
                                          • ?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ.QT5NETWORK ref: 6A646E26
                                          • ?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ.QT5NETWORK ref: 6A646E5A
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?state@AbstractSocketSocket@@State@1@
                                          • String ID:
                                          • API String ID: 3066076009-0
                                          • Opcode ID: d1ebb72bf439b4cb3c7ca7d869792a09925a97ed6fbe19de85ca6932215297fe
                                          • Instruction ID: a5ee1f77cca6098851e8b6841db010cf4f8028a965f3729017cd84e909c40a28
                                          • Opcode Fuzzy Hash: d1ebb72bf439b4cb3c7ca7d869792a09925a97ed6fbe19de85ca6932215297fe
                                          • Instruction Fuzzy Hash: 59A15978208B058FD765DBA5C498A6AB3E2FF81308F55C95CD4968B752CF31F886CB90
                                          Function 6A63C3B0 Relevance: 9.2, APIs: 6, Instructions: 235COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?write@QIODevice@@QAE_JPBD_J@Z.QT5CORE(-00000005,00000004,00000000), ref: 6A63C40C
                                          • ?write@QIODevice@@QAE_JPBD_J@Z.QT5CORE(?,?,00000000), ref: 6A63C45E
                                          • ?write@QIODevice@@QAE_JPBD_J@Z.QT5CORE(?,?,00000000), ref: 6A63C59C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?write@Device@@
                                          • String ID:
                                          • API String ID: 3565158716-0
                                          • Opcode ID: 73388b6f956c8678460f98d62baa7235aa2487aaeadabb00f74905f7c552254d
                                          • Instruction ID: 28c22cc5409556038c9a30203b7fc47b30e9311bddfd0c3d5cd5f4eefc5ce158
                                          • Opcode Fuzzy Hash: 73388b6f956c8678460f98d62baa7235aa2487aaeadabb00f74905f7c552254d
                                          • Instruction Fuzzy Hash: C781C1717092618FC308CF6CC894A2ABBE1BF99314F15866DF556C7392DB31E81ACB91
                                          Function 6A68E250 Relevance: 9.2, APIs: 6, Instructions: 163networkCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A68FA70: ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK(?,?,?,?,00000000,?), ref: 6A68FA92
                                            • Part of subcall function 6A68FA70: ?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ.QT5NETWORK(?,?,?,?,00000000,?), ref: 6A68FA9E
                                            • Part of subcall function 6A68FA70: htons.WS2_32(?), ref: 6A68FAC7
                                            • Part of subcall function 6A68FA70: ?toIPv4Address@QHostAddress@@QBEIXZ.QT5NETWORK(?,?,?,?,00000000,?), ref: 6A68FAD3
                                            • Part of subcall function 6A68FA70: htonl.WS2_32(00000000), ref: 6A68FAD9
                                          • ?toIPv4Address@QHostAddress@@QBEIXZ.QT5NETWORK(?,?,?), ref: 6A68E298
                                          • setsockopt.WS2_32(?,00000029,0000001B,?,00000004), ref: 6A68E2B7
                                          • WSAConnect.WS2_32(00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 6A68E2CD
                                          • WSAGetLastError.WS2_32 ref: 6A68E2DC
                                          • getsockopt.WS2_32(0000FFFF,0000FFFF,00001007,00000004,00000004), ref: 6A68E328
                                          • setsockopt.WS2_32(?,0000FFFF,00001007,?), ref: 6A68E35C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Address@@Host$?protocol@AbstractAddress@LayerNetworkProtocol@Socket@@setsockopt$ConnectErrorLastgetsockopthtonlhtons
                                          • String ID:
                                          • API String ID: 1778966637-0
                                          • Opcode ID: f28f857840b9024fce865e030de1af557f5105052aadc597ef0bb2cbea298400
                                          • Instruction ID: e3de7aa4430799ef552bf8cfaea39942c399877cc20a095bcbf69fdbd16a686a
                                          • Opcode Fuzzy Hash: f28f857840b9024fce865e030de1af557f5105052aadc597ef0bb2cbea298400
                                          • Instruction Fuzzy Hash: 0051C4F1288301EFE7209F65DC55B5B77E8EB47B04F050819F6929A2C0CFB5E9048BA6
                                          Function 6A6463A0 Relevance: 9.1, APIs: 6, Instructions: 131timenetworkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?disconnect@QObject@@SA_NPBV1@PBD01@Z.QT5CORE(?,00000000,?,00000000), ref: 6A6463D2
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A646437
                                          • ??1QHttp2Configuration@@QAE@XZ.QT5NETWORK ref: 6A646443
                                          • ??1QNetworkProxy@@QAE@XZ.QT5NETWORK(?,?), ref: 6A6464EE
                                          • ??1QTimer@@UAE@XZ.QT5CORE(?,?), ref: 6A6464F6
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6464FF
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$?disconnect@Configuration@@D01@Http2NetworkObject@@Proxy@@Timer@@
                                          • String ID:
                                          • API String ID: 1333847018-0
                                          • Opcode ID: 55c222913a08e4d3015655fd76e38860e14d651d6837f2402c015f1b41b36821
                                          • Instruction ID: d61e3162e671e604ddae61afd12543a34f24791e871d19821500afb5778ad957
                                          • Opcode Fuzzy Hash: 55c222913a08e4d3015655fd76e38860e14d651d6837f2402c015f1b41b36821
                                          • Instruction Fuzzy Hash: E5416C742017019FEB24CF69C884A56B3E4FF41329F1AC568E99ACB691EF35F845CB50
                                          Function 6A66A310 Relevance: 9.1, APIs: 6, Instructions: 101COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QHostAddress@@QAE@I@Z.QT5NETWORK(00000000,?,?,?,6BB6C190,?,?,?,6A670568,00000000,?,00000000,?,?,6BB6C190,?), ref: 6A66A350
                                            • Part of subcall function 6A669C10: ??0QMutex@@QAE@XZ.QT5CORE(?), ref: 6A669C27
                                            • Part of subcall function 6A669C10: ??0QString@@QAE@XZ.QT5CORE ref: 6A669C30
                                          • ??0QHostAddress@@QAE@I@Z.QT5NETWORK(9519B09E,?,?,?,6BB6C190,?,?,?,6A670568,00000000,?,00000000,?,?,6BB6C190,?), ref: 6A66A373
                                          • ??0QHostAddress@@QAE@PBE@Z.QT5NETWORK(?,?,?,?,?,?,6BB6C190,?,?,?,6A670568,00000000,?,00000000,?,?), ref: 6A66A3E2
                                          • ??0QMutex@@QAE@XZ.QT5CORE(?,?,?,6BB6C190,?,?,?,6A670568,00000000,?,00000000,?,?,6BB6C190,?,?), ref: 6A66A40A
                                          • ??0QString@@QAE@XZ.QT5CORE(?,6A670568,00000000,?,00000000,?,?,6BB6C190,?,?,6BB6C190,?,?,?,?), ref: 6A66A413
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Address@@Host$Mutex@@String@@
                                          • String ID:
                                          • API String ID: 3423998792-0
                                          • Opcode ID: 476d8c5e9d6e9f400eb3fb80076adf1d4dd1ebd9fd2ffea88d3c9da5d86f970c
                                          • Instruction ID: 7921593012cf3194b3d208f34a3c1cd18009d4e5db60acd10663bd0f56b481a4
                                          • Opcode Fuzzy Hash: 476d8c5e9d6e9f400eb3fb80076adf1d4dd1ebd9fd2ffea88d3c9da5d86f970c
                                          • Instruction Fuzzy Hash: 8731D4B2700B400BCA54EF39881962FB7E1AFF6214F450A1EE497C72D2DF20D559C396
                                          Function 6A686290 Relevance: 9.1, APIs: 6, Instructions: 83COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?clear@QRingBuffer@@QAEXXZ.QT5CORE ref: 6A6862BC
                                          • ?errorString@QIODevice@@QBE?AVQString@@XZ.QT5CORE(?), ref: 6A686303
                                          • ?error@QAbstractSocket@@QBE?AW4SocketError@1@XZ.QT5NETWORK ref: 6A686310
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A686322
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A686340
                                          • ??1QString@@QAE@XZ.QT5CORE(0000000A,00000000), ref: 6A686364
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$?clear@?error?error@AbstractBuffer@@Device@@Error@1@RingSocketSocket@@String@
                                          • String ID:
                                          • API String ID: 724294487-0
                                          • Opcode ID: a21921da280cf3638e764f4fe8b6b6e246d23ac358a1da820849602f3498ff9f
                                          • Instruction ID: e154c4231a50a58066a7cdd028845f6343700436e40d5def0cde311aa4367f3a
                                          • Opcode Fuzzy Hash: a21921da280cf3638e764f4fe8b6b6e246d23ac358a1da820849602f3498ff9f
                                          • Instruction Fuzzy Hash: B5212AB93112008BDB14DF64D4E8A6A77A9EF85355B010479E927CB2A2CF30EC48CB65
                                          Function 6A692AC0 Relevance: 9.1, APIs: 6, Instructions: 56COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?createNode@QMapDataBase@@QAEPAUQMapNodeBase@@HHPAU2@_N@Z.QT5CORE(00000014,00000004,00000000,00000000,00000000,00000000,?,6A6AA7C9,00000000), ref: 6A692AD3
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6A692AE2
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6A692AEF
                                          • ?setColor@QMapNodeBase@@QAEXW4Color@1@@Z.QT5CORE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6A692AFD
                                          • ?setParent@QMapNodeBase@@QAEXPAU1@@Z.QT5CORE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6A692B38
                                            • Part of subcall function 6A692AC0: ?setParent@QMapNodeBase@@QAEXPAU1@@Z.QT5CORE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6A692B16
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Base@@$Node$?set$Array@@ByteParent@U1@@V0@@$?createColor@Color@1@@DataNode@U2@_
                                          • String ID:
                                          • API String ID: 1995404194-0
                                          • Opcode ID: d92abe83616c16f770182e6d7a629c31fda32111216ec9d50a779aed08e27dd8
                                          • Instruction ID: ab68e8f451dcd58680bdb9ff9df0dd919a155e5d999188e6c3df4a0773376868
                                          • Opcode Fuzzy Hash: d92abe83616c16f770182e6d7a629c31fda32111216ec9d50a779aed08e27dd8
                                          • Instruction Fuzzy Hash: 13112EB2301602ABDB18CF66D898F96BBE8FF95715F01842DE157C3680CF70A844C794
                                          Function 6A638870 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,?,?,?,6A6C5AD0,?,?,?,?,?,?,?,?), ref: 6A6388AB
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,?,?,?,6A6C5AD0,?,?,?,?,?,?,?,?), ref: 6A6388B6
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(?,?,?,?,?,6A6C5AD0,?,?,?,?,?,?,?,?), ref: 6A6388CB
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(?,?,?,?,?,6A6C5AD0,?,?,?,?,?,?,?,?), ref: 6A6388D9
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,6A6C5AD0,?,?,?,?,?,?,?,?), ref: 6A6388F1
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,6A6C5AD0,?,?,?,?,?,?,?,?), ref: 6A6388FB
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$V0@@$E@$$
                                          • String ID:
                                          • API String ID: 4256490380-0
                                          • Opcode ID: 5a7ee6a40a9d93810f69da49f6fb12b6ff89354b0895609c7a1b0b0cdd5aae6c
                                          • Instruction ID: f6849b3326525e4509644fbe40b4d18b2d77d86203b0e1bb28ab55308d546383
                                          • Opcode Fuzzy Hash: 5a7ee6a40a9d93810f69da49f6fb12b6ff89354b0895609c7a1b0b0cdd5aae6c
                                          • Instruction Fuzzy Hash: EA110A71008212AFCB10DB55D85899ABBF8AFD2719F01941DE49B82160DB70B94ACBA1
                                          Function 6A62A3B0 Relevance: 9.0, APIs: 6, Instructions: 49timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?host@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?,?,6BB6C260,?,6BB6C200,6A62A1BD,?,?,?,?,00000000,00000002,?,?,?,?), ref: 6A62A3D0
                                          • ?host@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?,6BB6C204,?,?,?,?), ref: 6A62A3E9
                                          • ??8@YA_NABVQString@@0@Z.QT5CORE(00000000,00000000,?,?,?,?), ref: 6A62A3F1
                                          • ??8QDateTime@@QBE_NABV0@@Z.QT5CORE(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,6A629EEB,00000000), ref: 6A62A405
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6A629EEB,00000000,00000000), ref: 6A62A421
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6A629EEB,00000000,00000000), ref: 6A62A42B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$?host@ComponentFlags@FormattingOption@Url@@Url@@@@@$??8@DateString@@0@Time@@V0@@
                                          • String ID:
                                          • API String ID: 749526703-0
                                          • Opcode ID: 81af5199cadad7dde23c2b03cd7ceb2b9602e6d039e3cce6da4eb7851e97f1fb
                                          • Instruction ID: b71bcf5cf8fb3264c172368760b62de505bedd5e6b26b80c2de38ba6ac6d8452
                                          • Opcode Fuzzy Hash: 81af5199cadad7dde23c2b03cd7ceb2b9602e6d039e3cce6da4eb7851e97f1fb
                                          • Instruction Fuzzy Hash: AD0180B1104205AFCB00CF59D9989A67BF8EF9A705B054458F98ACB241DF30ED0ACF31
                                          Function 6A6903A0 Relevance: 9.0, APIs: 6, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QObjectPrivate@@QAE@H@Z.QT5CORE(00050F02), ref: 6A6903B7
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6903CF
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6903D8
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A6903F0
                                          • ??0QObject@@IAE@AAVQObjectPrivate@@PAV0@@Z.QT5CORE(00000000,?,?,?), ref: 6A69040B
                                          • ?writeNotification@QTcpServerPrivate@@UAEXXZ.QT5NETWORK(?,?,?), ref: 6A69041A
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Private@@String@@$Object$?writeNotification@Object@@ServerV0@@malloc
                                          • String ID:
                                          • API String ID: 1102946830-0
                                          • Opcode ID: da59e2fc7255f095f3213ed0a9a0936d2552c7dccb3289e378fbdfb25532834e
                                          • Instruction ID: 3a665e763c4ec2f751d4c7d8b43a97b306b8c134ad57f3cd3ef7430eb350f0a6
                                          • Opcode Fuzzy Hash: da59e2fc7255f095f3213ed0a9a0936d2552c7dccb3289e378fbdfb25532834e
                                          • Instruction Fuzzy Hash: 050128B42007118FC7649F26C858A5AFBF1FF86321B01091EE99783B80EB74B848CB51
                                          Function 6A670A10 Relevance: 9.0, APIs: 6, Instructions: 30COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE ref: 6A670A24
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A670A2D
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A670A37
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A670A48
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A670A51
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A670A5B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@ByteString@@V0@@$E@$$
                                          • String ID:
                                          • API String ID: 831028164-0
                                          • Opcode ID: 6843a01748733c181f5fb8f40f6dc91c88ff37e3d872bc7c18c686b5facf877b
                                          • Instruction ID: fa32834e5c9dd3753112894a55e7d854e2d3849021113fdcef1b393f7b18fc8f
                                          • Opcode Fuzzy Hash: 6843a01748733c181f5fb8f40f6dc91c88ff37e3d872bc7c18c686b5facf877b
                                          • Instruction Fuzzy Hash: 2CF0FEB22141119BCB08DB55D828AAEB7F8EB95612B11842EF11BC3251DF307D04CB91
                                          Function 6A6683D0 Relevance: 9.0, APIs: 6, Instructions: 30COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE ref: 6A6683E4
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A6683ED
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6683F7
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A668408
                                          • ??0QByteArray@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 6A668411
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A66841B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@ByteString@@V0@@$E@$$
                                          • String ID:
                                          • API String ID: 831028164-0
                                          • Opcode ID: 7f317107affcee0c17043f68636553e850cf1d6aedc0b1e79bc6ad8cff801ec9
                                          • Instruction ID: 77e480ca45d4702c34775fe29dbdbde640ef63dd961228da6c817200182ab9c5
                                          • Opcode Fuzzy Hash: 7f317107affcee0c17043f68636553e850cf1d6aedc0b1e79bc6ad8cff801ec9
                                          • Instruction Fuzzy Hash: 76F0F8B22041119BCB08DB65D828AAEB7F8EBA5657B11842EF21BC3290DF307D04CB91
                                          Function 6A61C970 Relevance: 9.0, APIs: 6, Instructions: 23timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,6A61C632,00000001,?,?,6A613240,?,00000000,00000000,6A656358), ref: 6A61C976
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A61C97F
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61C988
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61C991
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A61C99A
                                          • ??1QDateTime@@QAE@XZ.QT5CORE ref: 6A61C9A3
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Array@@Byte$DateTime@@
                                          • String ID:
                                          • API String ID: 664682113-0
                                          • Opcode ID: a4a32e5eb486a9e801139fe95cc69dcb8ba65f6bac2022a2bf4ff1117ae0cbc7
                                          • Instruction ID: 976566b83dc4834046cc2726fe6a32bab711bf03b34da9a5c2c6551b83172aaf
                                          • Opcode Fuzzy Hash: a4a32e5eb486a9e801139fe95cc69dcb8ba65f6bac2022a2bf4ff1117ae0cbc7
                                          • Instruction Fuzzy Hash: BCF01C701006168BCB249F22D86CF9A7BF0FF22706B02882DE05BC25A1DF30BD49CB80
                                          Function 6A68C3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Unable to initialize broadcast socket,00000000,000000FF), ref: 6A68C418
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(?), ref: 6A68C426
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A68C430
                                          Strings
                                          • Unable to initialize non-blocking socket, xrefs: 6A68C3FE
                                          • Unable to initialize broadcast socket, xrefs: 6A68C467
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$?tr@DateMetaObject@@Time@@V0@$$V0@@
                                          • String ID: Unable to initialize broadcast socket$Unable to initialize non-blocking socket
                                          • API String ID: 691198089-446118774
                                          • Opcode ID: fd11762200644d8a11108cc0515205cd0ef1bf17a9ea951145466472256353a3
                                          • Instruction ID: d6746201bb731bbab9076902ef086c7412bf0c5d554528695221bcfb40339f48
                                          • Opcode Fuzzy Hash: fd11762200644d8a11108cc0515205cd0ef1bf17a9ea951145466472256353a3
                                          • Instruction Fuzzy Hash: 33217C702057019BDB60DF58D844F9AB7F4BF95720F00465AE1A6876D1CF70B88ACB61
                                          Function 6A66E140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A66ECA0: ?lock@QMutex@@QAEXXZ.QT5CORE ref: 6A66ECB1
                                            • Part of subcall function 6A66ECA0: ??0QMutex@@QAE@XZ.QT5CORE ref: 6A66ED04
                                            • Part of subcall function 6A66ECA0: ??0QThreadPool@@QAE@PAVQObject@@@Z.QT5CORE(00000000), ref: 6A66ED38
                                            • Part of subcall function 6A66ECA0: ??0QMutex@@QAE@XZ.QT5CORE ref: 6A66ED41
                                            • Part of subcall function 6A66ECA0: ?instance@QCoreApplication@@SAPAV1@XZ.QT5CORE ref: 6A66ED4B
                                            • Part of subcall function 6A66ECA0: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PBV1@PAPAX01PAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PBHPBU3@@Z.QT5CORE(?,00000000,00000000,00000034,00000000,00000000,00000001,00000000,6BE521F8,0000000C), ref: 6A66ED93
                                            • Part of subcall function 6A66ECA0: ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A66EDA2
                                            • Part of subcall function 6A66ECA0: ?setMaxThreadCount@QThreadPool@@QAEXH@Z.QT5CORE(00000014), ref: 6A66EDAD
                                            • Part of subcall function 6A66ECA0: ?instance@QCoreApplication@@SAPAV1@XZ.QT5CORE ref: 6A66EDB9
                                            • Part of subcall function 6A66ECA0: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PBV1@PAPAX01PAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PBHPBU3@@Z.QT5CORE(?,00000000,?,00000000,00000000,00000000,00000001,00000000,6BE521F8,0000000C), ref: 6A66EDF8
                                            • Part of subcall function 6A66ECA0: ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A66EE01
                                          • ??1QString@@QAE@XZ.QT5CORE(?,?,?), ref: 6A66E191
                                          • ??1QString@@QAE@XZ.QT5CORE(?), ref: 6A66E1C4
                                          • ??0QString@@QAE@VQLatin1String@@@Z.QT5CORE(0000000D,Unknown error), ref: 6A66E206
                                          • ??0QString@@QAE@XZ.QT5CORE ref: 6A66E217
                                            • Part of subcall function 6A66D180: ?lock@QMutex@@QAEXXZ.QT5CORE(?,00000000,00000002,?,00000000,6A66DBAF,?,?,?), ref: 6A66D192
                                            • Part of subcall function 6A66D180: ?qHash@@YAIABVQString@@I@Z.QT5CORE(?,?,?,00000000,00000002,?,00000000,6A66DBAF,?,?,?), ref: 6A66D1BF
                                            • Part of subcall function 6A66D180: ?elapsed@QElapsedTimer@@QBE_JXZ.QT5CORE(?,00000000,?,00000000,00000002,?,00000000,6A66DBAF,?,?,?), ref: 6A66D22C
                                            • Part of subcall function 6A66D180: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000004), ref: 6A66D264
                                            • Part of subcall function 6A66D180: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(0000000C,00000008), ref: 6A66D27D
                                            • Part of subcall function 6A66D180: ?unlock@QMutexLocker@@QAEXXZ.QT5CORE ref: 6A66D2CF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$String@@$Connection@MetaMutex@@$Thread$?connect?instance@?lock@Application@@Array@@Base@ByteConnectionCoreImpl@ObjectPool@@Private@@Qt@@SlotType@U3@@V0@@$?elapsed@?set?unlock@Count@ElapsedHash@@Latin1Locker@@MutexObject@@@String@@@Timer@@
                                          • String ID: Unknown error
                                          • API String ID: 3291180526-83687255
                                          • Opcode ID: 69e189c2389a6e994691e3c4aa6698b0b02255bc75d7468aad5c5de207595143
                                          • Instruction ID: eb74f922dca969dacb9b1a751043e71180735a2434f214904ad07b500c56a18f
                                          • Opcode Fuzzy Hash: 69e189c2389a6e994691e3c4aa6698b0b02255bc75d7468aad5c5de207595143
                                          • Instruction Fuzzy Hash: 442168715047029FDB10CF65C804B4AFBF0EF46324F124A59E8AA972E1EB34E845DB92
                                          Function 6A69CA50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?lock@QMutex@@QAEXXZ.QT5CORE(?,6A6AF8CB,?,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 6A69CA64
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE(00000000,?,6A6AF8CB,?,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 6A69CB0B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?lock@?unlock@Locker@@MutexMutex@@
                                          • String ID: p/pj$p/pj$p/pj
                                          • API String ID: 914300419-77082285
                                          • Opcode ID: 2867810e02caebae13f510fb020d266f4f461dbf9dde3c60ed837475a9366498
                                          • Instruction ID: ed65a4e495bb338bb6536b0562eb46dd6f7e9c0dff3967ce13fff6bcd9871526
                                          • Opcode Fuzzy Hash: 2867810e02caebae13f510fb020d266f4f461dbf9dde3c60ed837475a9366498
                                          • Instruction Fuzzy Hash: 5921C0722006019FC718DB65C89497AFBF2EF81328B06886DE4A787294DF30F805CF42
                                          Function 6A638360 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QString@@QAE@XZ.QT5CORE(?,?,?,?), ref: 6A63836B
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000,?,?,?,?,?,?,?), ref: 6A6383AE
                                          • ?debug@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,failed to prepend a new field,?,?,?), ref: 6A6383BA
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(00000002,00000002,?,?,?,?,?), ref: 6A6383F5
                                          Strings
                                          • failed to prepend a new field, xrefs: 6A6383B4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?debug@Array@@ByteString@@
                                          • String ID: failed to prepend a new field
                                          • API String ID: 616251352-4022259531
                                          • Opcode ID: a2c083440aa9e017981a2d2d2f481d2de1f18d9ca9a224ec80490cda2d1a253c
                                          • Instruction ID: f217d6e0d110fea08f54d5f25fb93fba354264c36735bac225675f71fdb55fef
                                          • Opcode Fuzzy Hash: a2c083440aa9e017981a2d2d2f481d2de1f18d9ca9a224ec80490cda2d1a253c
                                          • Instruction Fuzzy Hash: 2B11E375508221ABDB109B11CC28F9FBFFAAFC5314F041859F4C6932A2DF31A942CB62
                                          Function 6A69CB20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?lock@QMutex@@QAEXXZ.QT5CORE ref: 6A69CB39
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE ref: 6A69CB9E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?lock@?unlock@Locker@@MutexMutex@@
                                          • String ID: p/pj$p/pj$p/pj
                                          • API String ID: 914300419-77082285
                                          • Opcode ID: ca31cb49981b94bcf050062d73d7f677b108108c58b8814fc3204c4f95889c38
                                          • Instruction ID: b3ae1c989fc33fa26ab433fe71b82dcd0e12b2843d4c78c13b4cd9494071e3cc
                                          • Opcode Fuzzy Hash: ca31cb49981b94bcf050062d73d7f677b108108c58b8814fc3204c4f95889c38
                                          • Instruction Fuzzy Hash: 7001D4F35106028FC3019B658808969FBE2AF85629B07459DE89B9B299DF30F801CFD5
                                          Function 6A69CBB0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?lock@QMutex@@QAEXXZ.QT5CORE ref: 6A69CBC9
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE ref: 6A69CC2E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?lock@?unlock@Locker@@MutexMutex@@
                                          • String ID: p/pj$p/pj$p/pj
                                          • API String ID: 914300419-77082285
                                          • Opcode ID: 61ca7be8025280c449cc6f84776cfc75c213041a50dea6a55c4bf182304abc84
                                          • Instruction ID: 534a1023a7106289a99d9a9608832220b81e5957bb523010d5354dea3584cbff
                                          • Opcode Fuzzy Hash: 61ca7be8025280c449cc6f84776cfc75c213041a50dea6a55c4bf182304abc84
                                          • Instruction Fuzzy Hash: AA01D4B3500602CFC7059B648814529BBA2AF85618B03099DE8A39B295DF30F802CBD5
                                          Function 6A68CA50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68CA6C
                                            • Part of subcall function 6A68EA90: WSAGetLastError.WS2_32 ref: 6A68EB9B
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QNativeSocketEngine::readDatagram() was called not in QAbstractSocket::BoundState or QAbstractSocket::ConnectedState), ref: 6A68CA78
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68CAA4
                                          Strings
                                          • QNativeSocketEngine::readDatagram() was called not in QAbstractSocket::BoundState or QAbstractSocket::ConnectedState, xrefs: 6A68CAAA
                                          • QNativeSocketEngine::readDatagram() was called on an uninitialized socket device, xrefs: 6A68CA72
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?warning@ErrorLast
                                          • String ID: QNativeSocketEngine::readDatagram() was called not in QAbstractSocket::BoundState or QAbstractSocket::ConnectedState$QNativeSocketEngine::readDatagram() was called on an uninitialized socket device
                                          • API String ID: 2434626678-1043305020
                                          • Opcode ID: 8142866b67e2198203abf51bcec6e4c06a66fc2ede8065bf12af34950df40705
                                          • Instruction ID: da27b65859d8388b40db5961b70c2a702db9b3afb41f38ae4ea00eb9ad06c5b4
                                          • Opcode Fuzzy Hash: 8142866b67e2198203abf51bcec6e4c06a66fc2ede8065bf12af34950df40705
                                          • Instruction Fuzzy Hash: FD018B71544200AFDB00EA68CC45F8A7BB4FF46724F614A19F267A60A1DF72F914DB62
                                          Function 6A6160F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31threadCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QThread@@QAE@PAVQObject@@@Z.QT5CORE(00000000,6A62682C), ref: 6A61610C
                                          • ?setObjectName@QObject@@QAEXABVQString@@@Z.QT5CORE ref: 6A61612A
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A616134
                                          • ?start@QThread@@QAEXW4Priority@1@@Z.QT5CORE(00000007), ref: 6A61613F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Thread@@$?set?start@Name@ObjectObject@@Object@@@Priority@1@@String@@String@@@malloc
                                          • String ID: l
                                          • API String ID: 1629626090-2517025534
                                          • Opcode ID: 1ef94b33094fb11cef801e3119f491d1e855ddc26d5a1d04879ecafc3aa69a71
                                          • Instruction ID: f31c75f4710d525a80e2f2b4aac154964902319d3c4bff1846b71cde55cd65a5
                                          • Opcode Fuzzy Hash: 1ef94b33094fb11cef801e3119f491d1e855ddc26d5a1d04879ecafc3aa69a71
                                          • Instruction Fuzzy Hash: 89F030B5604206ABD7849F5AC549B95BBF5FB85651F01401DF14BC3680DFB0B8548B91
                                          Function 6A64E8B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 29COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?number@QByteArray@@SA?AV1@_JH@Z.QT5CORE(?,?,?,0000000A), ref: 6A64E8C4
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(Content-Length,000000FF), ref: 6A64E8DA
                                            • Part of subcall function 6A64E910: ?compare@QByteArray@@QBEHABV1@W4CaseSensitivity@Qt@@@Z.QT5CORE(00000000,00000000,?,00000000,?,?,?,?,6A64E8ED,?,00000000), ref: 6A64E9A6
                                            • Part of subcall function 6A64E910: ?compare@QByteArray@@QBEHABV1@W4CaseSensitivity@Qt@@@Z.QT5CORE(?,00000000,?,00000000,?,?,?,?,6A64E8ED,?,00000000), ref: 6A64E9D8
                                            • Part of subcall function 6A64E910: ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(?,?,00000000,?,?,?,?,6A64E8ED,?,00000000), ref: 6A64E9E9
                                            • Part of subcall function 6A64E910: ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(?,?,00000000,?,?,?,?,6A64E8ED,?,00000000), ref: 6A64E9F6
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,00000000), ref: 6A64E8F1
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A64E8FB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?compare@CaseDateQt@@@Sensitivity@Time@@V0@$$V0@@$?number@V1@_
                                          • String ID: Content-Length
                                          • API String ID: 3658874276-3631502066
                                          • Opcode ID: 96a4764783d3055357ffdd8adcf8d8a0616de1d242ea62417dededffa2fb1f0d
                                          • Instruction ID: 5e039b71e348036e6ddc92838bf28493eeea82ed54db0245cf0315172a2c7801
                                          • Opcode Fuzzy Hash: 96a4764783d3055357ffdd8adcf8d8a0616de1d242ea62417dededffa2fb1f0d
                                          • Instruction Fuzzy Hash: C0F03AB1504202ABCB04DF51DC0CC9A7BB8FBD2211F014919F55382190EB30A908CB62
                                          Function 6A6A2270 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A6AD47B,00000000,00000000,00000000,00000000), ref: 6A6A2283
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A229E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,PEM_read_bio_RSAPrivateKey), ref: 6A6A22AF
                                          Strings
                                          • PEM_read_bio_RSAPrivateKey, xrefs: 6A6A22A4
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A22A9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: PEM_read_bio_RSAPrivateKey$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-4018349704
                                          • Opcode ID: 4143bde7978f1c26c642ea505aea9a2bbaf7906a2990bec5dac54c947143a445
                                          • Instruction ID: 0e9562caeeb96c257a54ba3163b5829c7dd9f7244b4d6ccec286e4043a65a084
                                          • Opcode Fuzzy Hash: 4143bde7978f1c26c642ea505aea9a2bbaf7906a2990bec5dac54c947143a445
                                          • Instruction Fuzzy Hash: 07E0D8B078020067DF1077FA8D0DB067BF06B06604F424498EA0BDA1A3EF65D5148666
                                          Function 6A6A0270 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A0283
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A029E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,BIO_meth_set_write), ref: 6A6A02AF
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A02A9
                                          • BIO_meth_set_write, xrefs: 6A6A02A4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: BIO_meth_set_write$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-3836334469
                                          • Opcode ID: e44eedd7df0fb9be7965091cf3d883b3f3aedf9a7f888a46f74f38f5b1055a03
                                          • Instruction ID: aee72554172be2ac724bf179898985f684c461c496ddf972a29c70d3c1620557
                                          • Opcode Fuzzy Hash: e44eedd7df0fb9be7965091cf3d883b3f3aedf9a7f888a46f74f38f5b1055a03
                                          • Instruction Fuzzy Hash: 72E092F064030067DF107BF98D0DB063AF06B06604F434454E60BDA1A3EF65D914C666
                                          Function 6A6A2A50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A2A63
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A2A7E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,SSL_CONF_CTX_set_flags), ref: 6A6A2A8F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2A89
                                          • SSL_CONF_CTX_set_flags, xrefs: 6A6A2A84
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$SSL_CONF_CTX_set_flags
                                          • API String ID: 646154281-583155894
                                          • Opcode ID: 049aa481f5d3c809e29b9e5cceae85ac4c8d86f7ccb670f383cc79941a070a57
                                          • Instruction ID: 8a9c732697f9fc3ab3524224a7d6de97664b523495111d7170e5e1fad726280b
                                          • Opcode Fuzzy Hash: 049aa481f5d3c809e29b9e5cceae85ac4c8d86f7ccb670f383cc79941a070a57
                                          • Instruction Fuzzy Hash: EAE0D8F46402016BDF207BFA8D0DB1A7BF06B01704F4244A8E707DA1A2EF66D5288666
                                          Function 6A6A0A50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A0A63
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A0A7E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,DTLS_server_method), ref: 6A6A0A8F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0A89
                                          • DTLS_server_method, xrefs: 6A6A0A84
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: DTLS_server_method$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-44331691
                                          • Opcode ID: be32c88355f524ed069471da99bbdf7c568538cfa977e188aff4f9717a07635a
                                          • Instruction ID: 2aa07f1b37623f824cf77e3b0154ccded40b5a4afcb91df220c54301167f071f
                                          • Opcode Fuzzy Hash: be32c88355f524ed069471da99bbdf7c568538cfa977e188aff4f9717a07635a
                                          • Instruction Fuzzy Hash: 20E0DFB47402016BCF207BF98D0EB0A7BF4AB01744F434468F70BCA1A3EF66D91486A6
                                          Function 6A6A4250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A4263
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A427E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,SSL_write), ref: 6A6A428F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A4289
                                          • SSL_write, xrefs: 6A6A4284
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$SSL_write
                                          • API String ID: 646154281-3204697840
                                          • Opcode ID: 1cb3fb060add4415d56170cca9efaeb6c8040bde248f54c5a6667ac08329fef3
                                          • Instruction ID: 3c5d322518b3eaf4d24f05e7c7ec83b2ca925b4adac6bca5c9780e53112f612b
                                          • Opcode Fuzzy Hash: 1cb3fb060add4415d56170cca9efaeb6c8040bde248f54c5a6667ac08329fef3
                                          • Instruction Fuzzy Hash: EEE092F46402006BCF1077B98D0EB097BB06B12704F474658E627DA1E2EF62D514866A
                                          Function 6A6A4A30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,6A6B0CE9,00000000,00000000), ref: 6A6A4A43
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,6A6B0CE9,00000000,00000000), ref: 6A6A4A5E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,X509_STORE_get_ex_data,?,?,6A6B0CE9,00000000,00000000), ref: 6A6A4A6F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A4A69
                                          • X509_STORE_get_ex_data, xrefs: 6A6A4A64
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$X509_STORE_get_ex_data
                                          • API String ID: 646154281-4224578287
                                          • Opcode ID: e17e781671730935432ee9d14cfda1c3f102e607b40deb5ca11d0daa5bcca830
                                          • Instruction ID: a93ab0b3ee5eeacef4dd498f873851418a5ea28ef1da8f4a6dc5b2645f4ce027
                                          • Opcode Fuzzy Hash: e17e781671730935432ee9d14cfda1c3f102e607b40deb5ca11d0daa5bcca830
                                          • Instruction Fuzzy Hash: 1EE0D8B064420057CF2077F58D0DB067BF0AB01704F474454E706CA1A7EF65D514866A
                                          Function 6A6A2210 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A6AD4BE,00000000,00000000,00000000,00000000), ref: 6A6A2223
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A223E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,PEM_read_bio_PrivateKey), ref: 6A6A224F
                                          Strings
                                          • PEM_read_bio_PrivateKey, xrefs: 6A6A2244
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2249
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: PEM_read_bio_PrivateKey$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-2345453618
                                          • Opcode ID: 8b6645c64621ee95e8d0847d2ea37c205abcd5711dbffdbcf4d3a90c85097c3e
                                          • Instruction ID: 7b42f12e5e337939f9767519ca253d9c2ea355d97838f58ded4470ec43b258ab
                                          • Opcode Fuzzy Hash: 8b6645c64621ee95e8d0847d2ea37c205abcd5711dbffdbcf4d3a90c85097c3e
                                          • Instruction Fuzzy Hash: 6FE0D8F064020067DF1077F68D0DB057BF06B45604F4244A8E70BDA1A6EF66D5158666
                                          Function 6A6A0210 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A0223
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A023E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,BIO_meth_set_read), ref: 6A6A024F
                                          Strings
                                          • BIO_meth_set_read, xrefs: 6A6A0244
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0249
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: BIO_meth_set_read$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-2034401384
                                          • Opcode ID: a30f8f6abd8a01cf1c8be2f928b147a9846d9ff5a5d7f38fb986052035e2577f
                                          • Instruction ID: 0ba48eaab38a8446a9d2cda8f174ca24849316e4a8e56b814ee6f2a4cb27705b
                                          • Opcode Fuzzy Hash: a30f8f6abd8a01cf1c8be2f928b147a9846d9ff5a5d7f38fb986052035e2577f
                                          • Instruction Fuzzy Hash: 2BE0D8F474030057DF107BF98D0DF057BF06B45608F434454E60BDA1A6EF65E514866A
                                          Function 6A6A4AF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,6A6B2E08,?,00000000,?,?,?,?,?,?,?,6A6B3294,?,00000000,?,?), ref: 6A6A4B03
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,6A6B2E08,?,00000000,?,?,?,?,?,?,?,6A6B3294), ref: 6A6A4B1E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,X509_STORE_set_ex_data,?,6A6B2E08,?,00000000,?,?,?,?,?,?,?,6A6B3294,?), ref: 6A6A4B2F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A4B29
                                          • X509_STORE_set_ex_data, xrefs: 6A6A4B24
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$X509_STORE_set_ex_data
                                          • API String ID: 646154281-3856811430
                                          • Opcode ID: 1e2460a07860c465561f0a1140f72c121bfac7c90a8e3dc906353ea14d8b6bb6
                                          • Instruction ID: 4a00881bb2df203344a4a1c6b5e4f1247f08366509e6e19a59e09d92a5234955
                                          • Opcode Fuzzy Hash: 1e2460a07860c465561f0a1140f72c121bfac7c90a8e3dc906353ea14d8b6bb6
                                          • Instruction Fuzzy Hash: B1E0D8F065020097CF1077FA8D0DB067BF0AB05604F464454E607CA1A2EF65E5148666
                                          Function 6A6A02D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A6AD706,00000000), ref: 6A6A02E3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A02FE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,BIO_new), ref: 6A6A030F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0309
                                          • BIO_new, xrefs: 6A6A0304
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: BIO_new$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-1326833877
                                          • Opcode ID: 9a802cd4c03a315a6b3a1750e630f6da6a877092a2356a00ea868a3abb52627d
                                          • Instruction ID: e6a1c1210d429b41ea34a3bb823b2304d215b3ae1422bc27759d72b524230385
                                          • Opcode Fuzzy Hash: 9a802cd4c03a315a6b3a1750e630f6da6a877092a2356a00ea868a3abb52627d
                                          • Instruction Fuzzy Hash: E3E0D8F06402019BCF1077F58D0DB063BF06F05644F4344A8E60ADA1A2EF65D51486B6
                                          Function 6A6A22D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A6AD471,00000000,00000000,00000000,00000000), ref: 6A6A22E3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A22FE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,PEM_read_bio_RSA_PUBKEY), ref: 6A6A230F
                                          Strings
                                          • PEM_read_bio_RSA_PUBKEY, xrefs: 6A6A2304
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2309
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: PEM_read_bio_RSA_PUBKEY$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-3526889254
                                          • Opcode ID: ce77090d955b3ee4bcc53aa6279373c2775926630162e2db85e256f35e9caf96
                                          • Instruction ID: c4f3503478a2ba3841330bad4b5f4454107a016c4823acfcecb5403f4e2f516b
                                          • Opcode Fuzzy Hash: ce77090d955b3ee4bcc53aa6279373c2775926630162e2db85e256f35e9caf96
                                          • Instruction Fuzzy Hash: 8FE048B06442019BDF1077F68D0EF057BF06F46608F4644A4E60ADA1A2EF65D51486BA
                                          Function 6A6A0AB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A0AC3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A0ADE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,DTLSv1_listen), ref: 6A6A0AEF
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0AE9
                                          • DTLSv1_listen, xrefs: 6A6A0AE4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: DTLSv1_listen$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-2568114013
                                          • Opcode ID: dc9d6fb200944b0d8ad1939ee0af8f97aa7630182ca5bd10bbcd5c0599e7551f
                                          • Instruction ID: e77d38ee9686c7474ea528d913b43d63c90236d5679e6c6ec92facba9ed50ce1
                                          • Opcode Fuzzy Hash: dc9d6fb200944b0d8ad1939ee0af8f97aa7630182ca5bd10bbcd5c0599e7551f
                                          • Instruction Fuzzy Hash: D5E092B06402005BCF1077BA8D0DB067BB4AF05704F474554E726CA2E3EF61D9248666
                                          Function 6A6A42B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,6A6AF87D,?,00000000,?,?,?,?,6A6B23C1,?), ref: 6A6A42C3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,6A6AF87D,?,00000000,?,?,?,?,6A6B23C1,?), ref: 6A6A42DE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,TLS_client_method,?,?,6A6AF87D,?,00000000,?,?,?,?,6A6B23C1,?), ref: 6A6A42EF
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A42E9
                                          • TLS_client_method, xrefs: 6A6A42E4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$TLS_client_method
                                          • API String ID: 646154281-2205130993
                                          • Opcode ID: c7f8276e09dadcc6fdfb46a34081e24d24fd14f167556197fc0f36dee571e0be
                                          • Instruction ID: d553712ad8fdcb7853f7713583282446578bd55d17df7560aa53b97314d0d566
                                          • Opcode Fuzzy Hash: c7f8276e09dadcc6fdfb46a34081e24d24fd14f167556197fc0f36dee571e0be
                                          • Instruction Fuzzy Hash: D0E0D8B464120057DF1077F98D0DB067BF06F01604F864454E607CA1A2EF65D5248666
                                          Function 6A6A4A90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,6A6B2CDC,?,?,?,?,?,?,?,6A6B3294,?,00000000,?,?,?), ref: 6A6A4AA3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,6A6B2CDC,?,?,?,?,?,?,?,6A6B3294,?), ref: 6A6A4ABE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,X509_STORE_new,?,?,6A6B2CDC,?,?,?,?,?,?,?,6A6B3294,?,00000000), ref: 6A6A4ACF
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A4AC9
                                          • X509_STORE_new, xrefs: 6A6A4AC4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$X509_STORE_new
                                          • API String ID: 646154281-4070349940
                                          • Opcode ID: e5b7f58af3daf47c4461b7df9130e50d3f28c874e1294656a479a7f5dfa66e86
                                          • Instruction ID: 9167ecf246e390678ed147ac86a9ac114d4da232fd1ffa9ebde9dc8522c69c65
                                          • Opcode Fuzzy Hash: e5b7f58af3daf47c4461b7df9130e50d3f28c874e1294656a479a7f5dfa66e86
                                          • Instruction Fuzzy Hash: 25E0D8F064020057CF1077F58D0EB06BBF0AB01708F424468EB06DA1A6EF65D924866A
                                          Function 6A6A2B70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A2B83
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A2B9E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,SSL_CTX_callback_ctrl), ref: 6A6A2BAF
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2BA9
                                          • SSL_CTX_callback_ctrl, xrefs: 6A6A2BA4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$SSL_CTX_callback_ctrl
                                          • API String ID: 646154281-3835852222
                                          • Opcode ID: 8715a3aec31d14626d8b1d735fafc4de99c01fddc9c3cbb5347a18faaa5abbdc
                                          • Instruction ID: ca103267757a8e1cfdf0de5053bb80587f23140ed0a94c386455f45575212ac4
                                          • Opcode Fuzzy Hash: 8715a3aec31d14626d8b1d735fafc4de99c01fddc9c3cbb5347a18faaa5abbdc
                                          • Instruction Fuzzy Hash: 0EE0D8F07402006BDF107BFB8D0DB057FF06B01608F4244A4E60ADA1B3EF65D51486AA
                                          Function 6A6A4370 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,?,6A6ACB1D,?,?,?), ref: 6A6A4383
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,?,6A6ACB1D,?,?,?), ref: 6A6A439E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,X509V3_EXT_d2i,?,?,?,6A6ACB1D,?,?,?), ref: 6A6A43AF
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A43A9
                                          • X509V3_EXT_d2i, xrefs: 6A6A43A4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$X509V3_EXT_d2i
                                          • API String ID: 646154281-1435081584
                                          • Opcode ID: ca051a96768ee5d76a6729c05ae7eb01a269ceaefcb28e73603882d8231e7599
                                          • Instruction ID: b99f96330364f4aabf58d61c175cce2ce7d0186d4bdb3b2e8040261816a7f5de
                                          • Opcode Fuzzy Hash: ca051a96768ee5d76a6729c05ae7eb01a269ceaefcb28e73603882d8231e7599
                                          • Instruction Fuzzy Hash: 35E0D8B065020097DF1077FA8D0EF097BF06B05604F424464E60BDA1A3EFA5D5158666
                                          Function 6A6A2330 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(00000000,00000001,00000000,00000000,?,?), ref: 6A6A2343
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?), ref: 6A6A235E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,PEM_write_bio_DSAPrivateKey,?,?), ref: 6A6A236F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2369
                                          • PEM_write_bio_DSAPrivateKey, xrefs: 6A6A2364
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: PEM_write_bio_DSAPrivateKey$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-228587887
                                          • Opcode ID: 713fb0e863b543d09c83cbca8399ac0f91fec95e8748c1c37f878a7640189eea
                                          • Instruction ID: 8c0ee139e761e8a470f4c5b7e21804e3fe167e08ec2283030365c149ea8a8c78
                                          • Opcode Fuzzy Hash: 713fb0e863b543d09c83cbca8399ac0f91fec95e8748c1c37f878a7640189eea
                                          • Instruction Fuzzy Hash: 99E0D8B0680200A7CF1077F68D0DB057BF06B06608F4244A4E646DA1A2EF66D5148666
                                          Function 6A6A0330 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,6A6A9C8E,00000000,?,?,6A697698,?), ref: 6A6A0343
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,6A6A9C8E,00000000,?,?,6A697698,?), ref: 6A6A035E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,BIO_new_mem_buf,?,6A6A9C8E,00000000,?,?,6A697698,?), ref: 6A6A036F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0369
                                          • BIO_new_mem_buf, xrefs: 6A6A0364
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: BIO_new_mem_buf$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-3113303254
                                          • Opcode ID: 600c22331f6f32f3e5a46f832e94e295a5e71c1d3e7e5b068ea6dbc14fb4f12a
                                          • Instruction ID: 0ef2e1df0613500ff87270face9b3d518e97116f237e36f2a582a93634de9e01
                                          • Opcode Fuzzy Hash: 600c22331f6f32f3e5a46f832e94e295a5e71c1d3e7e5b068ea6dbc14fb4f12a
                                          • Instruction Fuzzy Hash: 34E0D8B068020197CF1077F98D0DB063BF06B05604F434468E606CA1A2EF65D91486A6
                                          Function 6A6A2B10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A2B23
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A2B3E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,SSL_CONF_cmd), ref: 6A6A2B4F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2B49
                                          • SSL_CONF_cmd, xrefs: 6A6A2B44
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$SSL_CONF_cmd
                                          • API String ID: 646154281-3221592941
                                          • Opcode ID: a1a4bcf8fb9934416bff8013c1371cc78b28410a735fb776fb08d9b6216472f8
                                          • Instruction ID: 1bf78d93aa08a3d36e6fd254bd14d215fcbabbcbc4668c198ff8b9aee60302d2
                                          • Opcode Fuzzy Hash: a1a4bcf8fb9934416bff8013c1371cc78b28410a735fb776fb08d9b6216472f8
                                          • Instruction Fuzzy Hash: B4E0D8F16402006BCF107BF68D0DB057BF06B01608F424498E607DB1B2EF65D515866A
                                          Function 6A6A0B10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,6A6AD68B,00000000,?), ref: 6A6A0B23
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,6A6AD68B,00000000,?), ref: 6A6A0B3E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,EC_GROUP_get_degree,?,?,6A6AD68B,00000000,?), ref: 6A6A0B4F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0B49
                                          • EC_GROUP_get_degree, xrefs: 6A6A0B44
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: EC_GROUP_get_degree$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-938085248
                                          • Opcode ID: 67014ccd5c3d81038f02b6e21641b693af149dcc4c23197729c5b4116f968978
                                          • Instruction ID: d20ef14f2d15c28762a013de38938678c3889a514bfd4b1031396acbab4e1459
                                          • Opcode Fuzzy Hash: 67014ccd5c3d81038f02b6e21641b693af149dcc4c23197729c5b4116f968978
                                          • Instruction Fuzzy Hash: 43E0D8F564020067CF1077F58D0EB063BF06B05609F434494E607DB1A6EF66E514C6A6
                                          Function 6A6A4310 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A4323
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A433E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,TLS_server_method), ref: 6A6A434F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A4349
                                          • TLS_server_method, xrefs: 6A6A4344
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$TLS_server_method
                                          • API String ID: 646154281-2947928708
                                          • Opcode ID: f26522faecf6deef277e906801e17864bd5bc56295af7236d01fd906b3d47a95
                                          • Instruction ID: 7fb4e49dcf5460cb6b535d782dd15512394eb5be919e1690f73d3e17d66c68ed
                                          • Opcode Fuzzy Hash: f26522faecf6deef277e906801e17864bd5bc56295af7236d01fd906b3d47a95
                                          • Instruction Fuzzy Hash: 15E0D8B06503009BCF1077F68D0EB067BF06B05604F464454E60ACA2A2EFA5D524C677
                                          Function 6A6A23F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(00000000,00000001,00000000,00000000,?,?), ref: 6A6A2403
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?), ref: 6A6A241E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,PEM_write_bio_ECPrivateKey,?,?), ref: 6A6A242F
                                          Strings
                                          • PEM_write_bio_ECPrivateKey, xrefs: 6A6A2424
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2429
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: PEM_write_bio_ECPrivateKey$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-828354778
                                          • Opcode ID: c4122989e5fbf00f5f201608ac4aca9c404da3beb7e0ac4e7ec20c97812b50c6
                                          • Instruction ID: 253205ee39d30cce2e6e62730dbea98bf0bed03c650e06a6eb40548a530e457f
                                          • Opcode Fuzzy Hash: c4122989e5fbf00f5f201608ac4aca9c404da3beb7e0ac4e7ec20c97812b50c6
                                          • Instruction Fuzzy Hash: A5E0D8B074020167CF1077F68D0DB05BBF06B05604F8244A8F606DA1E2EF65D5148666
                                          Function 6A6A03F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,6A6AD700), ref: 6A6A0403
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,6A6AD700), ref: 6A6A041E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,BIO_s_mem,?,6A6AD700), ref: 6A6A042F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0429
                                          • BIO_s_mem, xrefs: 6A6A0424
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: BIO_s_mem$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-1150480819
                                          • Opcode ID: 1e9a824ebb9d3d626970b32a627391885717c66f5cdd265b0754e8dd298e8de9
                                          • Instruction ID: ee1bb1319235d96d72e33af766b16d61d816f82ba9cd6589811344e2c9ce1669
                                          • Opcode Fuzzy Hash: 1e9a824ebb9d3d626970b32a627391885717c66f5cdd265b0754e8dd298e8de9
                                          • Instruction Fuzzy Hash: EAE0D8F07402009BCF1077F58D0DB057BF07B05604F834494E60ACA1E2EF65D514C6A6
                                          Function 6A6A2BD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A2BE3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A2BFE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,SSL_CTX_check_private_key), ref: 6A6A2C0F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2C09
                                          • SSL_CTX_check_private_key, xrefs: 6A6A2C04
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$SSL_CTX_check_private_key
                                          • API String ID: 646154281-3210356484
                                          • Opcode ID: 02087678d212298c051175095f288bd1797cbbfd3377b085163829d16057c165
                                          • Instruction ID: f32fa5833502f0bb32f5ca0de8c285f06d8bb57202ba60a050e7a03151f30af4
                                          • Opcode Fuzzy Hash: 02087678d212298c051175095f288bd1797cbbfd3377b085163829d16057c165
                                          • Instruction Fuzzy Hash: F4E092B06442405BDF0077BA8D0EB057AB06B01604F4645A4F627DA2F2EF61D51486A6
                                          Function 6A6A0BD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,?,6A6AD685,?), ref: 6A6A0BE3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,?,6A6AD685,?), ref: 6A6A0BFE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,EC_KEY_get0_group,?,?,?,6A6AD685,?), ref: 6A6A0C0F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0C09
                                          • EC_KEY_get0_group, xrefs: 6A6A0C04
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: EC_KEY_get0_group$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-361053210
                                          • Opcode ID: f8e710091970d0ca0cff5224b9c75f5257b8400fbc6331ef22328105098886b2
                                          • Instruction ID: fcf1b7eda5a557a5007e9f3cd5da7f982ec2419e3a0da7908dd06be3423850f5
                                          • Opcode Fuzzy Hash: f8e710091970d0ca0cff5224b9c75f5257b8400fbc6331ef22328105098886b2
                                          • Instruction Fuzzy Hash: E5E0D8B064420057DF107BF58D0EB067BF06B05704F434464E607CA2A2EF65D91886B6
                                          Function 6A6A43D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,6A6ACB25,?,?,?,?), ref: 6A6A43E3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,6A6ACB25,?,?,?,?), ref: 6A6A43FE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,X509V3_EXT_get,?,?,6A6ACB25,?,?,?,?), ref: 6A6A440F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A4409
                                          • X509V3_EXT_get, xrefs: 6A6A4404
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$X509V3_EXT_get
                                          • API String ID: 646154281-3241378403
                                          • Opcode ID: cda261a56ca56c784f510f83fa69fe93d58a633e23fcb6ab5636f731ea2b5f09
                                          • Instruction ID: 3f23891ecd69525212dc66d239abebae5f6521abcbbe8558e9cd8ce53a54e304
                                          • Opcode Fuzzy Hash: cda261a56ca56c784f510f83fa69fe93d58a633e23fcb6ab5636f731ea2b5f09
                                          • Instruction Fuzzy Hash: 12E0D8B464020067CF1077F98D0DF05BBF4AB05604F424474E607DA1A2EF65D52486B6
                                          Function 6A6A4BB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A4BC3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A4BDE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,X509_check_issued), ref: 6A6A4BEF
                                          Strings
                                          • X509_check_issued, xrefs: 6A6A4BE4
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A4BE9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$X509_check_issued
                                          • API String ID: 646154281-1322028787
                                          • Opcode ID: a67d647a2b98435b929469bde7fde8795e9f2dc63883e62d4ba20df823e94ba9
                                          • Instruction ID: 8b5e35d2e4841dcab26a13a4f635b01f2a1347b25f854c7f55c027e5c3617985
                                          • Opcode Fuzzy Hash: a67d647a2b98435b929469bde7fde8795e9f2dc63883e62d4ba20df823e94ba9
                                          • Instruction Fuzzy Hash: 33E0D8F56402005BDF0077F98D0EB057BB06F01B04F464554F62ADE1E2EFA1E5148666
                                          Function 6A6A2390 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,6A6AD76F,00000000,?,?,?), ref: 6A6A23A3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,6A6AD76F,00000000,?,?,?), ref: 6A6A23BE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,PEM_write_bio_DSA_PUBKEY,?,6A6AD76F,00000000,?,?,?), ref: 6A6A23CF
                                          Strings
                                          • PEM_write_bio_DSA_PUBKEY, xrefs: 6A6A23C4
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A23C9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: PEM_write_bio_DSA_PUBKEY$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-1414460325
                                          • Opcode ID: dd08ee4296f0148597c249d5b20e3247eb7b316ea56d671733f211b66fc096e7
                                          • Instruction ID: 311026dae4708d68baf1a06a1e84ebbe879739e34229b85dbd9fdb1e64d1468c
                                          • Opcode Fuzzy Hash: dd08ee4296f0148597c249d5b20e3247eb7b316ea56d671733f211b66fc096e7
                                          • Instruction Fuzzy Hash: 17E0D8F06402009BDF1077FA8D0DB067FF06B01604F424498E616DA1A3EFA5D918C6A6
                                          Function 6A6A0390 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,?,00000000,?), ref: 6A6A03A3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,?,00000000,?), ref: 6A6A03BE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,BIO_read,?,?,?,00000000,?), ref: 6A6A03CF
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A03C9
                                          • BIO_read, xrefs: 6A6A03C4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: BIO_read$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-1956383423
                                          • Opcode ID: 3181ad4ef91b0e2c046f6a37b8815d65bdf31a001e99a42a69e0b508a91db2a6
                                          • Instruction ID: 7e1b560d58c42132a4893fe2a2df15b64615f9248469f428d74236be0baae578
                                          • Opcode Fuzzy Hash: 3181ad4ef91b0e2c046f6a37b8815d65bdf31a001e99a42a69e0b508a91db2a6
                                          • Instruction Fuzzy Hash: B1E092F06002019BCF107BBA8D0DB097AF46B05604F564594E616EA2E2EFA1D9248666
                                          Function 6A6A2870 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,00000100,000000FF,00000000,00000000), ref: 6A6A2883
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A289E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,SSL_CIPHER_description), ref: 6A6A28AF
                                          Strings
                                          • SSL_CIPHER_description, xrefs: 6A6A28A4
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A28A9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$SSL_CIPHER_description
                                          • API String ID: 646154281-4149912388
                                          • Opcode ID: 4370ffe58e5840250b366599dc44a9ab098636d843250046217300fce34d6243
                                          • Instruction ID: 5da376420c0b787194b127372f27e45a709bab2dae00dbcd086cbdf8cb15124a
                                          • Opcode Fuzzy Hash: 4370ffe58e5840250b366599dc44a9ab098636d843250046217300fce34d6243
                                          • Instruction Fuzzy Hash: 69E048B06442006BDF1077FA8D0DF1A7BF06B45604F464498F606DA1B3EF65D518866A
                                          Function 6A6A4850 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,6A6B0CFE,?,00000000), ref: 6A6A4863
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,6A6B0CFE,?,00000000), ref: 6A6A487E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,X509_STORE_CTX_get_ex_data,?,?,6A6B0CFE,?,00000000), ref: 6A6A488F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A4889
                                          • X509_STORE_CTX_get_ex_data, xrefs: 6A6A4884
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$X509_STORE_CTX_get_ex_data
                                          • API String ID: 646154281-328436054
                                          • Opcode ID: 4a711ed9be9e92a07197bd1d0c07de9f2c5bab6270be449479b445831584ade3
                                          • Instruction ID: 3e225828decc92f61c2c049c067aafbb589eea17defe9c877b24db7a4cc17947
                                          • Opcode Fuzzy Hash: 4a711ed9be9e92a07197bd1d0c07de9f2c5bab6270be449479b445831584ade3
                                          • Instruction Fuzzy Hash: 69E0D8B475020067CF2077F58D0DB097BF4AB41604F464454E60BCB1A3EF66D5148666
                                          Function 6A6A2030 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A6AD49F,00000000,00000000,00000000,00000000), ref: 6A6A2043
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A205E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,PEM_read_bio_DSAPrivateKey), ref: 6A6A206F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2069
                                          • PEM_read_bio_DSAPrivateKey, xrefs: 6A6A2064
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: PEM_read_bio_DSAPrivateKey$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-668654418
                                          • Opcode ID: e28e859dc519a5e47fa89f09b2015a54a4d9605382b17e45a6bd40e65c6bbc79
                                          • Instruction ID: 48392c62af31704856168c32e874fecd3ad97147a328ea0de8ce41622c6df994
                                          • Opcode Fuzzy Hash: e28e859dc519a5e47fa89f09b2015a54a4d9605382b17e45a6bd40e65c6bbc79
                                          • Instruction Fuzzy Hash: B0E0D8B078020157CF1077FA8D0DB067BF06B05704F424494E61BDA1A2EF65D914C6A6
                                          Function 6A6A0030 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A0043
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A005E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,BIO_meth_new), ref: 6A6A006F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0069
                                          • BIO_meth_new, xrefs: 6A6A0064
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: BIO_meth_new$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-3290152829
                                          • Opcode ID: 763142e5c69a416d982824960c4bd5e7a54a8c1faed26da38bc0223c69d9f62c
                                          • Instruction ID: 00cfeaf49e4104905777d7925f43f7233061b874e16289053e61a77a4e46a94e
                                          • Opcode Fuzzy Hash: 763142e5c69a416d982824960c4bd5e7a54a8c1faed26da38bc0223c69d9f62c
                                          • Instruction Fuzzy Hash: 68E0D8F078420057CF107BF98D0DF163BF06B05604F434454E607CA1A2EF65D514C666
                                          Function 6A6A0810 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,6A6A9D84,?,?), ref: 6A6A0823
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,6A6A9D84,?,?), ref: 6A6A083E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,DH_check,?,?,6A6A9D84,?,?), ref: 6A6A084F
                                          Strings
                                          • DH_check, xrefs: 6A6A0844
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0849
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: DH_check$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-1034400718
                                          • Opcode ID: ba37efe9207c6239f708808dcaf5910eff71cefb41736c09b5208b92f8a12c38
                                          • Instruction ID: 4ff1ffc980b880af7e10b26682810b905b364c697a2af948573919b8b4e0043e
                                          • Opcode Fuzzy Hash: ba37efe9207c6239f708808dcaf5910eff71cefb41736c09b5208b92f8a12c38
                                          • Instruction Fuzzy Hash: E4E0D8B46402005BCF107BF58D0EB057BF06B01604F834468E60BDA1A2EF66E51486AA
                                          Function 6A6A20F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A6AD514,00000000,00000000,00000000,00000000), ref: 6A6A2103
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A211E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,PEM_read_bio_ECPrivateKey), ref: 6A6A212F
                                          Strings
                                          • PEM_read_bio_ECPrivateKey, xrefs: 6A6A2124
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2129
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: PEM_read_bio_ECPrivateKey$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-458627361
                                          • Opcode ID: cef1b24f7631b830d4dbd9572208ecca3707a6bd7b28594a668ecba735aae324
                                          • Instruction ID: ecffb019d1acafdbfc2df6a619b0fb269f901c84e90c63d32a0603e9f6e525ec
                                          • Opcode Fuzzy Hash: cef1b24f7631b830d4dbd9572208ecca3707a6bd7b28594a668ecba735aae324
                                          • Instruction Fuzzy Hash: 56E0D8F07802005BDF1077F68D0DF05BBF06F05604F4244A4E706DA2A2EF65D9148666
                                          Function 6A6A00F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A0103
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A011E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,BIO_meth_set_ctrl), ref: 6A6A012F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0129
                                          • BIO_meth_set_ctrl, xrefs: 6A6A0124
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: BIO_meth_set_ctrl$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-3897364996
                                          • Opcode ID: 33502c3d616397112929b8b7152fb55fc01bfbaea47152eb3e817273c2b47980
                                          • Instruction ID: 697531543c23372f99e34e38594d5914b8e1515450c6e46f5ce0842e1fe5ea5e
                                          • Opcode Fuzzy Hash: 33502c3d616397112929b8b7152fb55fc01bfbaea47152eb3e817273c2b47980
                                          • Instruction Fuzzy Hash: F2E0D8F064030057CF507BF58D0DF057BF06B05605F434454E606CA1A2EF65D914C6A7
                                          Function 6A6A28D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A28E3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A28FE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,SSL_CIPHER_get_bits), ref: 6A6A290F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2909
                                          • SSL_CIPHER_get_bits, xrefs: 6A6A2904
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$SSL_CIPHER_get_bits
                                          • API String ID: 646154281-54262349
                                          • Opcode ID: f0c7bebc26689e5d79fb0f605867927ff78f94a7e2bb614907db2009c14deac6
                                          • Instruction ID: be06e22258db991588f1e5364dec821bc58998c21e1472e6279baae4785850ba
                                          • Opcode Fuzzy Hash: f0c7bebc26689e5d79fb0f605867927ff78f94a7e2bb614907db2009c14deac6
                                          • Instruction Fuzzy Hash: EBE048F06442006BDF5077F78D0DF097BF46B45604F4684A4E60ADA1A2EF65D514C6BA
                                          Function 6A6A48B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A6B2F32,00000000,?,00000000,00000000), ref: 6A6A48C3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6A6B3294), ref: 6A6A48DE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,X509_STORE_CTX_init,?,?,?,?,?,?,?,?,?,?,?,6A6B3294,?), ref: 6A6A48EF
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A48E9
                                          • X509_STORE_CTX_init, xrefs: 6A6A48E4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$X509_STORE_CTX_init
                                          • API String ID: 646154281-680206421
                                          • Opcode ID: 04eb8e66e824500ec8f9bdb23ba9a443827e002f1895eb477547028def795168
                                          • Instruction ID: a125d0c97fd10d8c805c166e8d59f922f3772c9bb61f32ce590c56eafe616bc3
                                          • Opcode Fuzzy Hash: 04eb8e66e824500ec8f9bdb23ba9a443827e002f1895eb477547028def795168
                                          • Instruction Fuzzy Hash: 2DE092B060024057CF0077B98D0DB067AB06F01704F464558F626DA1E2EF61D5148666
                                          Function 6A6A2090 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A6AD498,00000000,00000000,00000000,00000000), ref: 6A6A20A3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A20BE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,PEM_read_bio_DSA_PUBKEY), ref: 6A6A20CF
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A20C9
                                          • PEM_read_bio_DSA_PUBKEY, xrefs: 6A6A20C4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: PEM_read_bio_DSA_PUBKEY$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-3491414655
                                          • Opcode ID: 3b4fbb1b54d221ce5df1ae67ffbb0766281af1c0cd1ac18c18bbe0ccccd141f1
                                          • Instruction ID: b7ebe1166cca27bdfb6080ad283db0c4196a1414d41627e3e9e9c9d868ba323f
                                          • Opcode Fuzzy Hash: 3b4fbb1b54d221ce5df1ae67ffbb0766281af1c0cd1ac18c18bbe0ccccd141f1
                                          • Instruction Fuzzy Hash: BEE0D8F07402006BCF1077F68D0EB067BF06B05604F424498E616EA1A2EF65D514C6A6
                                          Function 6A6A0090 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A00A3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A00BE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,BIO_meth_set_create), ref: 6A6A00CF
                                          Strings
                                          • BIO_meth_set_create, xrefs: 6A6A00C4
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A00C9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: BIO_meth_set_create$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-1516623708
                                          • Opcode ID: 203c01e6f52feb124251c14f5557b54d2ae42e2364b65124e833442db4cf9300
                                          • Instruction ID: 1694c077f31dc094b8dca91195a96237a413f78f1c485587bf2e8080ac08087d
                                          • Opcode Fuzzy Hash: 203c01e6f52feb124251c14f5557b54d2ae42e2364b65124e833442db4cf9300
                                          • Instruction Fuzzy Hash: 1BE0D8F074020067DF107BF58D0EF163BF06B05604F434498E60BEA1A2EF65D5188676
                                          Function 6A6A4970 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,6A6B2DDF,?,00000000,?,?,?,?,?,?,6A6B3294,?,00000000,?,?), ref: 6A6A4983
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,6A6B2DDF,?,00000000,?,?,?,?,?,?,6A6B3294), ref: 6A6A499E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,X509_STORE_add_cert,?,?,6A6B2DDF,?,00000000,?,?,?,?,?,?,6A6B3294,?), ref: 6A6A49AF
                                          Strings
                                          • X509_STORE_add_cert, xrefs: 6A6A49A4
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A49A9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$X509_STORE_add_cert
                                          • API String ID: 646154281-2195579877
                                          • Opcode ID: 64a630dd4b9c61fbb9c726266e2c73c3c341a77887bbfd281ffa79e4f7a12bd4
                                          • Instruction ID: 14ab23695a22f59bbb5332a09927b00c3fe328ef4b96df2f9da4f6ec32a7f1b3
                                          • Opcode Fuzzy Hash: 64a630dd4b9c61fbb9c726266e2c73c3c341a77887bbfd281ffa79e4f7a12bd4
                                          • Instruction Fuzzy Hash: E4E0D8B064020067DF1077F58D0EB057BF46B05608F428464F606DA1A3EF65D525C666
                                          Function 6A6A2150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A6AD50D,00000000,00000000,00000000,00000000), ref: 6A6A2163
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A217E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,PEM_read_bio_EC_PUBKEY), ref: 6A6A218F
                                          Strings
                                          • PEM_read_bio_EC_PUBKEY, xrefs: 6A6A2184
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2189
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: PEM_read_bio_EC_PUBKEY$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-2234020887
                                          • Opcode ID: 5dfaf36741cbed0f42c5adb28a90fe027da3f07b9a5aa77b2637c6be619baebc
                                          • Instruction ID: d6282fba6e3d014addd57f29bf7a2d5f7995a56d9a8cebab0c8f733deb149b53
                                          • Opcode Fuzzy Hash: 5dfaf36741cbed0f42c5adb28a90fe027da3f07b9a5aa77b2637c6be619baebc
                                          • Instruction Fuzzy Hash: 3EE0D8B47402005BCF2077F68D0DF0A7BF06B46704F424494EB0BDA1A2EF65D924C6A6
                                          Function 6A6A0150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A0163
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A017E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,BIO_meth_set_destroy), ref: 6A6A018F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0189
                                          • BIO_meth_set_destroy, xrefs: 6A6A0184
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: BIO_meth_set_destroy$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-954603311
                                          • Opcode ID: 022464705311f59ba9f50299c40c0ad33de7b71b92aa3fc3d892ce696bf0ac31
                                          • Instruction ID: bcf5544a44fcb3d5c227b9fd89b8c16a24bafd35db391b8e3681e84bb16d735b
                                          • Opcode Fuzzy Hash: 022464705311f59ba9f50299c40c0ad33de7b71b92aa3fc3d892ce696bf0ac31
                                          • Instruction Fuzzy Hash: 99E0D8F464020057DF20BBF58D0DF093BF06B05644F434454E60BCA1A2EF65D914866A
                                          Function 6A6A2AB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A2AC3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A2ADE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,SSL_CONF_CTX_set_ssl_ctx), ref: 6A6A2AEF
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2AE9
                                          • SSL_CONF_CTX_set_ssl_ctx, xrefs: 6A6A2AE4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$SSL_CONF_CTX_set_ssl_ctx
                                          • API String ID: 646154281-2253949383
                                          • Opcode ID: 591001b2e066f991ae216563821321e9d93cc80c6d3d6d96f23978b92dbca026
                                          • Instruction ID: 0d2594406f9c7b0c5583f159b1e2ca5b9a0ff715cf3586b8082784a3bc8ac1ea
                                          • Opcode Fuzzy Hash: 591001b2e066f991ae216563821321e9d93cc80c6d3d6d96f23978b92dbca026
                                          • Instruction Fuzzy Hash: 91E0D8F06402005BCF1077F68D0DB0A7BB06F05705F424494E71ACA1A2EF61D518876A
                                          Function 6A6A0B70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A697B02,00000001,?,6A695A06), ref: 6A6A0B83
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A0B9E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,EC_KEY_free), ref: 6A6A0BAF
                                          Strings
                                          • EC_KEY_free, xrefs: 6A6A0BA4
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0BA9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: EC_KEY_free$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-1093401952
                                          • Opcode ID: e0ca54444a49cc286726d691ca6388f5a7f2de1226d42898fa5cb2d6712d84fc
                                          • Instruction ID: bcc4ce25698d2a94977d32ad679632516ffe08b0ece8f5e8669af978b9951574
                                          • Opcode Fuzzy Hash: e0ca54444a49cc286726d691ca6388f5a7f2de1226d42898fa5cb2d6712d84fc
                                          • Instruction Fuzzy Hash: 04E0D8F160020097CF1077F68E0DB057BF06B06608F434094F60ACE1A7EF22D9188666
                                          Function 6A6A4B50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(?,?,6A6B2EA7,?,6A6B0CC0,?,?,?,?,?,?,?,?,?,6A6B3294,?), ref: 6A6A4B63
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?,?,?,6A6B2EA7,?,6A6B0CC0), ref: 6A6A4B7E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,X509_STORE_set_verify_cb,?,?,6A6B2EA7,?,6A6B0CC0), ref: 6A6A4B8F
                                          Strings
                                          • X509_STORE_set_verify_cb, xrefs: 6A6A4B84
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A4B89
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$X509_STORE_set_verify_cb
                                          • API String ID: 646154281-1558625510
                                          • Opcode ID: 192f4bae10d99d8a303ed5d395592dcac49b1e66045eeb956d3ce5f0d1abaa1c
                                          • Instruction ID: 20ce21e6da780b593977f2c97cd61af5d880cc18dd89706158942fffad3e6de5
                                          • Opcode Fuzzy Hash: 192f4bae10d99d8a303ed5d395592dcac49b1e66045eeb956d3ce5f0d1abaa1c
                                          • Instruction Fuzzy Hash: 40E0D8F5A402009BDF1077F58D0DF093BB06B15604F474054E60BCA1A3EF62D514866A
                                          Function 6A6A0870 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A697B02,00000001,?,6A695A06), ref: 6A6A0883
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A089E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,DH_free), ref: 6A6A08AF
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A08A9
                                          • DH_free, xrefs: 6A6A08A4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: DH_free$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-2990544216
                                          • Opcode ID: 3a73f5d070de52bd5346940ee5317b70e6bd0c1e3fe64bc2692e3c70fececafc
                                          • Instruction ID: a55d14c40a74e55da6172241b27c77248300a3df7d95ca2701bbe8cb1c63dfca
                                          • Opcode Fuzzy Hash: 3a73f5d070de52bd5346940ee5317b70e6bd0c1e3fe64bc2692e3c70fececafc
                                          • Instruction Fuzzy Hash: 58E048F06442009BDF107BF98D0EB1A7BB46B05604F974458F606DA1A3EF71D918C6AA
                                          Function 6A6A4070 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A4083
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A409E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,SSL_set_psk_server_callback), ref: 6A6A40AF
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A40A9
                                          • SSL_set_psk_server_callback, xrefs: 6A6A40A4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$SSL_set_psk_server_callback
                                          • API String ID: 646154281-3156912888
                                          • Opcode ID: 195f7aa478d5f86bdc7bb7b7ee695f0a422e6ec616eb7f22e30bbb17c74bf3d4
                                          • Instruction ID: 039f60d61d446f73ce6d87ae60e781df3085ccfc204d98f98ac942d96ed14267
                                          • Opcode Fuzzy Hash: 195f7aa478d5f86bdc7bb7b7ee695f0a422e6ec616eb7f22e30bbb17c74bf3d4
                                          • Instruction Fuzzy Hash: 12E0D8F06442009BCF0077F98D0EB067BF06B05604F434058E616CA1A3EF61D51886AA
                                          Function 6A6A2810 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE(6A697B02,00000001,?,6A695A06), ref: 6A6A2823
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A283E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,RSA_free), ref: 6A6A284F
                                          Strings
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A2849
                                          • RSA_free, xrefs: 6A6A2844
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$RSA_free
                                          • API String ID: 646154281-2186402356
                                          • Opcode ID: 5d83b3794b44826a326c7971f82b4735474163c6cb7d0148f4ccff21deb1e956
                                          • Instruction ID: 78e72df3e9203f19aba4badf993198e006b7e4efd9922d16fce4f6baeb37d0b7
                                          • Opcode Fuzzy Hash: 5d83b3794b44826a326c7971f82b4735474163c6cb7d0148f4ccff21deb1e956
                                          • Instruction Fuzzy Hash: 19E0D8F06802405BCF0077F68D0DB057BB06B11604F434098F60BCA1A2EF31D519866A
                                          Function 6A6A4010 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A4023
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A403E
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,SSL_set_psk_client_callback), ref: 6A6A404F
                                          Strings
                                          • SSL_set_psk_client_callback, xrefs: 6A6A4044
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A4049
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$SSL_set_psk_client_callback
                                          • API String ID: 646154281-1349065601
                                          • Opcode ID: 23168d31af2a9b4bae8b6b6fb59a8fd62af63ff8cd91f44445c6598d179c5b7a
                                          • Instruction ID: ce9384fd65ae3b26d3b331f9ebdbd9190fab62bf74df8932fcbb2844c0f2f25f
                                          • Opcode Fuzzy Hash: 23168d31af2a9b4bae8b6b6fb59a8fd62af63ff8cd91f44445c6598d179c5b7a
                                          • Instruction Fuzzy Hash: F5E0D8F06042009BCF0077F58D0EB057BB06B01604F438054E62BCA1A2EF61D518D66E
                                          Function 6A6A08D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A08E3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A08FE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,DH_get0_pqg), ref: 6A6A090F
                                          Strings
                                          • DH_get0_pqg, xrefs: 6A6A0904
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A0909
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: DH_get0_pqg$QSslSocket: cannot call unresolved function %s
                                          • API String ID: 646154281-2115103235
                                          • Opcode ID: 9dcce268cce6980ae730d99976cd0db5ee857b7d115f8300208cf69d6cb71c38
                                          • Instruction ID: 1907e3de8d5f82b71a97fc54a95e312adf4bb0a567dffbb1526eff49064020ff
                                          • Opcode Fuzzy Hash: 9dcce268cce6980ae730d99976cd0db5ee857b7d115f8300208cf69d6cb71c38
                                          • Instruction Fuzzy Hash: 5EE0D8F06402006BEF1077F58D0DB057BB46B01704F478064E60ACA1A2EF61DA1486B6
                                          Function 6A6A40D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A6A40E3
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A6A40FE
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslSocket: cannot call unresolved function %s,SSL_set_psk_use_session_callback), ref: 6A6A410F
                                          Strings
                                          • SSL_set_psk_use_session_callback, xrefs: 6A6A4104
                                          • QSslSocket: cannot call unresolved function %s, xrefs: 6A6A4109
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslSocket: cannot call unresolved function %s$SSL_set_psk_use_session_callback
                                          • API String ID: 646154281-3471750969
                                          • Opcode ID: 4122ce12273f2d9db94b1e67f786599ca4c5dceeb4bff3be5cd0124478e8bd43
                                          • Instruction ID: 45c67bb962a2abe85b496244cc9fa9dc532891c2cb39abcd07189f02f47ccae4
                                          • Opcode Fuzzy Hash: 4122ce12273f2d9db94b1e67f786599ca4c5dceeb4bff3be5cd0124478e8bd43
                                          • Instruction Fuzzy Hash: 1AE0D8F068020057CF0077F98D0EB193BB06B11644F4340A8E606DA1A6EF61D91886B6
                                          Function 6A67C390 Relevance: 7.6, APIs: 5, Instructions: 124registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?utf16@QString@@QBEPBGXZ.QT5CORE(00000000,00020019,?,00000000,6A702EFC,6A67CC21,80000001,?), ref: 6A67C3A4
                                          • RegOpenKeyExW.ADVAPI32(?,00000000), ref: 6A67C3AF
                                          • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000000), ref: 6A67C3C3
                                          • RegNotifyChangeKeyValue.ADVAPI32(?,00000001,0000000F,00000000,00000001), ref: 6A67C3D6
                                          • CloseHandle.KERNEL32(00000000), ref: 6A67C3E1
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?utf16@ChangeCloseCreateEventHandleNotifyOpenString@@Value
                                          • String ID:
                                          • API String ID: 868953856-0
                                          • Opcode ID: 89e196ba18ac69f0222e3c3104eaea92192d5e0c27e36ea8a4597f3754896ce2
                                          • Instruction ID: 5c8f765ae6a642e13161f76a54589b9b5ab17aec07ce66080ceda21d23e19c97
                                          • Opcode Fuzzy Hash: 89e196ba18ac69f0222e3c3104eaea92192d5e0c27e36ea8a4597f3754896ce2
                                          • Instruction Fuzzy Hash: 394159312102019FD728CF18C994E6AB7E9FB89714B25C65DE4ABCB296CB31EC41CB50
                                          Function 6A6AA030 Relevance: 7.6, APIs: 5, Instructions: 107COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(00000001,00000001,00000000,00000000), ref: 6A6AA06C
                                            • Part of subcall function 6A6AB960: ??0QVariant@@QAE@ABV0@@Z.QT5CORE(00000000,6BC95110,6A6ACE94,?), ref: 6A6AB98F
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,?,?,?,-00000010,?,00000000,00000000), ref: 6A6AA0F9
                                          • ??0QVariant@@QAE@ABV0@@Z.QT5CORE(?,?,6BC95110,6A6ACE94,?), ref: 6A6AA11F
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(00000000,6BC95110,6A6ACE94,?), ref: 6A6AA134
                                          • ??0QVariant@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A6AA14C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@ListV0@@Variant@@$?append@?detach_grow@?dispose@Data@1@Data@1@@
                                          • String ID:
                                          • API String ID: 302352845-0
                                          • Opcode ID: c142e09baa58799db5723875b3ae04175ee76ca246d702ae5c7a39a9d99369ce
                                          • Instruction ID: bc357769b1774c96ce891c63f63d5a07752b15a59b0ff4a0b8db1dabb29a9331
                                          • Opcode Fuzzy Hash: c142e09baa58799db5723875b3ae04175ee76ca246d702ae5c7a39a9d99369ce
                                          • Instruction Fuzzy Hash: 3031C4716002089FDB00CF58DC84A69B3E5FF45318F154569EA16DB382DB32FD29CBA5
                                          Function 6A674380 Relevance: 7.6, APIs: 5, Instructions: 103COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1df7f53ccbbb052b236e4bc6e0513433a1259895d9b9b01da954be84f9ff460a
                                          • Instruction ID: 34eeb78265236327f1730247fe822317443bede149b4be1cd96e8ec462d26f10
                                          • Opcode Fuzzy Hash: 1df7f53ccbbb052b236e4bc6e0513433a1259895d9b9b01da954be84f9ff460a
                                          • Instruction Fuzzy Hash: F831E6B22181516BC712CF58C598992FBB6FF452243164189D8DA8F64BCB31FC93DBA0
                                          Function 6A686020 Relevance: 7.6, APIs: 5, Instructions: 100COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,?), ref: 6A6860CA
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK ref: 6A6860D6
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK ref: 6A6860F4
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK ref: 6A6860FC
                                          • ??1QObject@@UAE@XZ.QT5CORE ref: 6A68610E
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Address@@Host$?dispose@Data@1@@Data@@ListObject@@
                                          • String ID:
                                          • API String ID: 316120433-0
                                          • Opcode ID: ef8358ec80ccb137a5586ea4f029c62b8682b6fbd0d7ae738f38d322b71ec815
                                          • Instruction ID: 03f3d794a045b585c3b816f0c8cd9b52a0f3f3d2bdc759c339aa74a911722196
                                          • Opcode Fuzzy Hash: ef8358ec80ccb137a5586ea4f029c62b8682b6fbd0d7ae738f38d322b71ec815
                                          • Instruction Fuzzy Hash: 3A310675220A008BE720CF64C844F5A73A8BF06715F064158E836DB292DF31F914CBA9
                                          Function 6A662BF0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(?,00000001,?,?,?,00000000,?,6A664A98,?), ref: 6A662C28
                                          • memmove.VCRUNTIME140(?,?,?,?,?,?,00000000,?,6A664A98,?), ref: 6A662C5E
                                          • memmove.VCRUNTIME140(?,?,00000000,?,?,?,00000000,?,6A664A98,?), ref: 6A662C97
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,?,00000000,?,6A664A98,?), ref: 6A662CBB
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?,00000000,?,6A664A98,?), ref: 6A662CE2
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@List$memmove$?append@?detach_grow@?dispose@Data@1@Data@1@@
                                          • String ID:
                                          • API String ID: 3006242278-0
                                          • Opcode ID: 540fba3c36d319fff9912d17a8c9f91adfe8153efe27e15be74ca62d4ff3513f
                                          • Instruction ID: b6b73537548d8334211bf7712c761930dfb35b604277fd3e4fb5415b75ed941f
                                          • Opcode Fuzzy Hash: 540fba3c36d319fff9912d17a8c9f91adfe8153efe27e15be74ca62d4ff3513f
                                          • Instruction Fuzzy Hash: 6E31E87160020ACFD704CF6CD8C0E66B3A9FF80354B294A69E925C7391DB32ED2ACB51
                                          Function 6A678A90 Relevance: 7.6, APIs: 5, Instructions: 93COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QSharedData@@QAE@ABV0@@Z.QT5CORE(6BB6B980,?,6A6797BA,?), ref: 6A678AC2
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(6BB6B984), ref: 6A678ACF
                                          • ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(?,6BB208B0), ref: 6A678AFF
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A678B33
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A678B68
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: V0@@$Array@@ByteData@@$?detach@Data@1@ListSharedString@@malloc
                                          • String ID:
                                          • API String ID: 2121237843-0
                                          • Opcode ID: 77f9d719de4776c3c158dcad7dccf1d0104f7cfb85ca956f736b1ac720e3fc0e
                                          • Instruction ID: 57d1fa74c2106e94b860360182ddcc36885451ec01a58d7ce83105d9d6e11f63
                                          • Opcode Fuzzy Hash: 77f9d719de4776c3c158dcad7dccf1d0104f7cfb85ca956f736b1ac720e3fc0e
                                          • Instruction Fuzzy Hash: B631A4B16002148FCB25DF19C880A59B7B0FF86724B56416DEC2A9B361DF31FD4ACB91
                                          Function 6A6AE2A0 Relevance: 7.6, APIs: 5, Instructions: 86COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QSslError@@QAE@XZ.QT5NETWORK(?,6A6B30DA,?,?,?), ref: 6A6AE2A7
                                            • Part of subcall function 6A698D00: ??0QString@@QAE@XZ.QT5CORE(00000000,?,?,?), ref: 6A698D19
                                            • Part of subcall function 6A698D00: ??0QSslCertificate@@QAE@ABVQByteArray@@W4EncodingFormat@QSsl@@@Z.QT5NETWORK(00000000), ref: 6A698D23
                                            • Part of subcall function 6A698D00: ??1QByteArray@@QAE@XZ.QT5CORE(00000000), ref: 6A698D2C
                                            • Part of subcall function 6A698D00: ??0QString@@QAE@XZ.QT5CORE(00000000), ref: 6A698D40
                                            • Part of subcall function 6A698D00: ??0QSslCertificate@@QAE@ABVQByteArray@@W4EncodingFormat@QSsl@@@Z.QT5NETWORK(00000000), ref: 6A698D4B
                                            • Part of subcall function 6A698D00: ??1QSslCertificate@@QAE@XZ.QT5NETWORK(00000000), ref: 6A698D60
                                            • Part of subcall function 6A698D00: ??1QByteArray@@QAE@XZ.QT5CORE(00000000), ref: 6A698D69
                                          • ??0QSslError@@QAE@W4SslError@0@ABVQSslCertificate@@@Z.QT5NETWORK(00000001,6A6B30DA,000000FF,6A6B30DA,6A6B30DA,?,?,?), ref: 6A6AE2CA
                                          • ??1QSslError@@QAE@XZ.QT5NETWORK(00000001,6A6B30DA,000000FF,6A6B30DA,6A6B30DA,?,?,?), ref: 6A6AE2DD
                                          • ??0QSslError@@QAE@W4SslError@0@ABVQSslCertificate@@@Z.QT5NETWORK(000000FF,6A6B30DA,?,6A6B30DA,?,?,?), ref: 6A6AE387
                                          • ??1QSslError@@QAE@XZ.QT5NETWORK(000000FF,6A6B30DA,?,6A6B30DA,?,?,?), ref: 6A6AE398
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Error@@$Array@@Byte$Certificate@@$Certificate@@@EncodingError@0@Format@Ssl@@@String@@
                                          • String ID:
                                          • API String ID: 192334143-0
                                          • Opcode ID: 422518684b5b7b7bb673add934c7398d6a15a01780f61654939d1c446f4068d9
                                          • Instruction ID: ac1132ff57bdf13415a50063320033ff541dc9472e1c00c5996acdb0e4d3e74f
                                          • Opcode Fuzzy Hash: 422518684b5b7b7bb673add934c7398d6a15a01780f61654939d1c446f4068d9
                                          • Instruction Fuzzy Hash: 23316C31789392FBD731CE48C801B9ABBA1BB9AB50F044C0DF3A1561E0CB71D8949B43
                                          Function 6A64E230 Relevance: 7.6, APIs: 5, Instructions: 81COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QSharedData@@QAE@ABV0@@Z.QT5CORE(6A6518D0,?,?,00000000,6A6518D0,?,?), ref: 6A64E23A
                                          • ??0QMutex@@QAE@XZ.QT5CORE ref: 6A64E243
                                          • ??4QUrl@@QAEAAV0@ABV0@@Z.QT5CORE(6A6518D4), ref: 6A64E258
                                          • ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(?), ref: 6A64E28D
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,?,?,?,?), ref: 6A64E30E
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@$ListV0@@$?detach@?dispose@Data@1@Data@1@@Mutex@@SharedUrl@@
                                          • String ID:
                                          • API String ID: 2376331311-0
                                          • Opcode ID: 2f3a32567cfbc171a44a3316daf3d81af8d62e346c8ded7bb59817bbf5c2296a
                                          • Instruction ID: 43f4504c909bfb99366b9912b2498b00eae897fb56bd3e1ed8d0ade92490a964
                                          • Opcode Fuzzy Hash: 2f3a32567cfbc171a44a3316daf3d81af8d62e346c8ded7bb59817bbf5c2296a
                                          • Instruction Fuzzy Hash: 02313AB42043069FD704DF99C884D5AB7F8FF46328B058A2DF46AC7291DB30E959CBA1
                                          Function 6A694B50 Relevance: 7.6, APIs: 5, Instructions: 80COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?subjectInfo@QSslCertificate@@QBE?AVQStringList@@W4SubjectInfo@1@@Z.QT5NETWORK(?,00000001,00000000,?,6A69355D,?), ref: 6A694B66
                                            • Part of subcall function 6A6ABF60: ?lock@QMutex@@QAEXXZ.QT5CORE(00000000,6A6D0084,00000001,?,?,?,6BB9ECB0), ref: 6A6ABF83
                                            • Part of subcall function 6A6ABF60: ??1QByteArray@@QAE@XZ.QT5CORE(?,00000000,00000000,6A6D0084,00000001,?,?,?,6BB9ECB0), ref: 6A6AC006
                                            • Part of subcall function 6A6ABF60: ?unlock@QMutexLocker@@QAEXXZ.QT5CORE(?,?,6BB9ECB0), ref: 6A6AC010
                                            • Part of subcall function 6A6132C0: ??1QString@@QAE@XZ.QT5CORE(00000000,6A6D0084,00000000,6A694819), ref: 6A613305
                                            • Part of subcall function 6A6132C0: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,00000000,6A6D0084,00000000,6A694819), ref: 6A613310
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000000,?,00000000,?,00000001,00000000,?,6A69355D,?), ref: 6A694BAD
                                          • ?subjectInfo@QSslCertificate@@QBE?AVQStringList@@W4SubjectInfo@1@@Z.QT5NETWORK(?,00000000,?,00000001,00000000,?,6A69355D,?), ref: 6A694BD0
                                          • ?subjectInfo@QSslCertificate@@QBE?AVQStringList@@W4SubjectInfo@1@@Z.QT5NETWORK(?,00000003,?,00000000,?,00000001,00000000,?,6A69355D,?), ref: 6A694C12
                                          • ??0QString@@QAE@XZ.QT5CORE(?,00000003,?,00000000,?,00000001,00000000,?,6A69355D,?), ref: 6A694C53
                                            • Part of subcall function 6A693B80: ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(?,?,00000000,00000000,?,00000000,6A694A18,?,00000000,?,00000001,00000000,?,6A693539,?), ref: 6A693BB0
                                            • Part of subcall function 6A693B80: ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,6A693539,?), ref: 6A693BD3
                                            • Part of subcall function 6A693B80: ??1QString@@QAE@XZ.QT5CORE(?,6A693539,?), ref: 6A693C17
                                            • Part of subcall function 6A693B80: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,?,6A693539,?), ref: 6A693C22
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?subjectArray@@ByteCertificate@@Data@@Info@Info@1@@ListList@@StringString@@Subject$?dispose@Data@1@@V0@@$?detach@?lock@?unlock@Data@1@Locker@@MutexMutex@@
                                          • String ID:
                                          • API String ID: 3402220352-0
                                          • Opcode ID: 6cf63cd32bf4cc41e741db8345cb0b5296636ecfb9651dd59fabf2eb13d81474
                                          • Instruction ID: 41fa1bdfa97a0402b3017e75647f1beabdae58466502a4044af263381a03c2a6
                                          • Opcode Fuzzy Hash: 6cf63cd32bf4cc41e741db8345cb0b5296636ecfb9651dd59fabf2eb13d81474
                                          • Instruction Fuzzy Hash: 7A31F574508301AFC744DF54C5A895ABBF4EF89B14F01C81DE49A87365EB34EC48CB56
                                          Function 6A664360 Relevance: 7.6, APIs: 5, Instructions: 75COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?qHash@@YAIABVQString@@I@Z.QT5CORE(?,?,?,6BB044C0,?,?,?,6A663183,?), ref: 6A664399
                                          • ??8@YA_NABVQString@@0@Z.QT5CORE(?,-00000008,?,00000000,?,6BB044C0,?,?,?,6A663183,?), ref: 6A6643C7
                                          • ??1QString@@QAE@XZ.QT5CORE(?,00000000,?,6BB044C0,?,?,?,6A663183,?), ref: 6A6643E4
                                          • ?freeNode@QHashData@@QAEXPAX@Z.QT5CORE(?,?,6BB044C0,?,?,?,6A663183,?), ref: 6A6643ED
                                          • ?hasShrunk@QHashData@@QAEXXZ.QT5CORE(?,6BB044C0,?,?,?,6A663183,?), ref: 6A664404
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@HashString@@$??8@?free?hasHash@@Node@Shrunk@String@@0@
                                          • String ID:
                                          • API String ID: 155359095-0
                                          • Opcode ID: 61f1afe7aeb17dce33f0e17e667a59064bc45b8bd204ba0b0cb1b3e75bb6e292
                                          • Instruction ID: 00c9d71846800c2affd0242384ab915de75e390e2fed07e70c8af65ec1f2a5f0
                                          • Opcode Fuzzy Hash: 61f1afe7aeb17dce33f0e17e667a59064bc45b8bd204ba0b0cb1b3e75bb6e292
                                          • Instruction Fuzzy Hash: 13218375114202DFD700CF99D8D8A5AFBF4FF55325F15802AE80687252CF70AD54CBA1
                                          Function 6A6728E0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QSharedData@@QAE@ABV0@@Z.QT5CORE ref: 6A672908
                                          • ??0QUrl@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A672915
                                          • ??0QMutex@@QAE@XZ.QT5CORE ref: 6A67293D
                                          • ??0QMutex@@QAE@XZ.QT5CORE ref: 6A672946
                                          • ??1QUrl@@QAE@XZ.QT5CORE(?,?,6A673CC5), ref: 6A672975
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Mutex@@Url@@V0@@$Data@@Sharedmalloc
                                          • String ID:
                                          • API String ID: 3741404693-0
                                          • Opcode ID: 8230e682200c0a55ce2e0de120ca701b79dac91e28ee11af7f10f6269ce28049
                                          • Instruction ID: f4547192bd6ee7d2d443a655a21390ae8448d7051aec12c0d5955e28817a475c
                                          • Opcode Fuzzy Hash: 8230e682200c0a55ce2e0de120ca701b79dac91e28ee11af7f10f6269ce28049
                                          • Instruction Fuzzy Hash: B421D3B57016129FDB21CF6AC884B55B7F1FF46321B1946A9E42ACB294DF30F811CB91
                                          Function 6A644A80 Relevance: 7.6, APIs: 5, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QSharedData@@QAE@ABV0@@Z.QT5CORE ref: 6A644AAB
                                            • Part of subcall function 6A6446E0: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A61A7F0), ref: 6A6447A3
                                            • Part of subcall function 6A6446E0: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A61A7F0), ref: 6A644818
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?), ref: 6A644AC4
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A644AD1
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A644B06
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A644B0F
                                            • Part of subcall function 6A61F950: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A61A7F0,00000001,00000001,6A6201BD), ref: 6A61F99C
                                            • Part of subcall function 6A61F950: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A61A7F0), ref: 6A61F9C8
                                            • Part of subcall function 6A61F950: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000001,?,?), ref: 6A61FA05
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@$?free_helper@Array@@ByteHashNode@1@@$V0@@$?dispose@Data@1@@ListSharedmalloc
                                          • String ID:
                                          • API String ID: 4171170058-0
                                          • Opcode ID: 1b69af353249a92d54fb80eedf6e518aafd0632ceed6e685bf1628f0eb70c7fd
                                          • Instruction ID: 2fff83bc9eb3535d43be2cae6b1466ff00f39be9a087b7eaf06ba65893568aa2
                                          • Opcode Fuzzy Hash: 1b69af353249a92d54fb80eedf6e518aafd0632ceed6e685bf1628f0eb70c7fd
                                          • Instruction Fuzzy Hash: 4E215BB11006018FCB54CF69D894A96B7F4FF192143124269E88BC7695DF30FD45CF94
                                          Function 6A678940 Relevance: 7.6, APIs: 5, Instructions: 55COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QSharedData@@QAE@ABV0@@Z.QT5CORE(6BB6B980,?), ref: 6A678967
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(6BB6B984), ref: 6A678974
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(6BB6B98C), ref: 6A678987
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6789AC
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6789B5
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: V0@@$Array@@ByteString@@$Data@@Sharedmalloc
                                          • String ID:
                                          • API String ID: 3965549148-0
                                          • Opcode ID: 81c28bb0011322e3dd8187a1d7887811eb3d3f45cd6f493fa3a9edb7eb615a3e
                                          • Instruction ID: 1852388207306fb020a157994ce934fb2e02302f487c70ec15e7fae43d7437be
                                          • Opcode Fuzzy Hash: 81c28bb0011322e3dd8187a1d7887811eb3d3f45cd6f493fa3a9edb7eb615a3e
                                          • Instruction Fuzzy Hash: CA1179712006028FDB51CF68D894A9AB3B4FF057253114269E92BCB2A5EF30FD95CBA1
                                          Function 6A678820 Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QSharedData@@QAE@ABV0@@Z.QT5CORE(6BB6B980,?), ref: 6A678843
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(6BB6B984), ref: 6A678850
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(6BB6B98C), ref: 6A678863
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A678880
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A678889
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: V0@@$Array@@ByteString@@$Data@@Sharedmalloc
                                          • String ID:
                                          • API String ID: 3965549148-0
                                          • Opcode ID: 7268dab10cdbe12131c917cceba78ca25ed1f9e3426efe63c99f78f18e1e3e79
                                          • Instruction ID: 684442e178dd81c510035d906c4be13198541cf126be6f70ce9568349a64c477
                                          • Opcode Fuzzy Hash: 7268dab10cdbe12131c917cceba78ca25ed1f9e3426efe63c99f78f18e1e3e79
                                          • Instruction Fuzzy Hash: E4118B716006028FDB50CF69D894A56B3B4FF057253154169E91ACB2A4DF30FD95CB50
                                          Function 6A6788B0 Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QSharedData@@QAE@ABV0@@Z.QT5CORE(6BB6B980,?), ref: 6A6788D3
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(6BB6B984), ref: 6A6788E0
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(6BB6B98C), ref: 6A6788F3
                                          • ??1QHostAddress@@QAE@XZ.QT5NETWORK(6BB6B98C), ref: 6A67890F
                                            • Part of subcall function 6A669E10: ??1QString@@QAE@XZ.QT5CORE(00000000,6A6ABD95,?), ref: 6A669E29
                                          • ??1QString@@QAE@XZ.QT5CORE(6BB6B98C), ref: 6A678917
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: V0@@$SharedString@@$Address@@Array@@Authenticator@@ByteData@@Hostmalloc
                                          • String ID:
                                          • API String ID: 3502257756-0
                                          • Opcode ID: 5a2bab0f7122408d34379b9121a5a362e965cb64b865b11087e32dbd49286986
                                          • Instruction ID: d49b1589017ecc740879ab13eeaf4cec1fb01139f8e44defc8b9e052b6a34694
                                          • Opcode Fuzzy Hash: 5a2bab0f7122408d34379b9121a5a362e965cb64b865b11087e32dbd49286986
                                          • Instruction Fuzzy Hash: 2011A9722006118FDB50CF6CD884A9AB3B8FF067293124569E85ACB2A5DF30FD95CB95
                                          Function 6A69A970 Relevance: 7.6, APIs: 5, Instructions: 52networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setProtocolTag@QAbstractSocket@@QAEXABVQString@@@Z.QT5NETWORK(?), ref: 6A69A9BB
                                          • ?proxy@QAbstractSocket@@QBE?AVQNetworkProxy@@XZ.QT5NETWORK(?,?), ref: 6A69A9CD
                                          • ?setProxy@QAbstractSocket@@QAEXABVQNetworkProxy@@@Z.QT5NETWORK(00000000,?), ref: 6A69A9D5
                                          • ??1QNetworkProxy@@QAE@XZ.QT5NETWORK(00000000,?), ref: 6A69A9DE
                                          • ?open@QIODevice@@UAE_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z.QT5CORE(?,00000000,?), ref: 6A69A9E9
                                            • Part of subcall function 6A69B690: ??1QOcspResponse@@QAE@XZ.QT5NETWORK ref: 6A69B6F7
                                            • Part of subcall function 6A69B690: ?clear@QRingBuffer@@QAEXXZ.QT5CORE ref: 6A69B71F
                                            • Part of subcall function 6A69B690: ?clear@QRingBuffer@@QAEXXZ.QT5CORE ref: 6A69B728
                                            • Part of subcall function 6A69B690: ?clear@QSslCertificate@@QAEXXZ.QT5NETWORK ref: 6A69B730
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?clear@AbstractNetworkSocket@@$?setBuffer@@Proxy@@Ring$?open@?proxy@Certificate@@Device@@Device@@@@@Flag@Flags@ModeOcspOpenProtocolProxy@Proxy@@@Response@@String@@@Tag@
                                          • String ID:
                                          • API String ID: 2408991192-0
                                          • Opcode ID: 43dde646e3a27e98346b089fb4d4dadea3319a22a17b89449fbdf8cc1896e164
                                          • Instruction ID: 16156629262de4620ed49730a166c8d8ce2f6e9bda64c48de0aacb1237d1850f
                                          • Opcode Fuzzy Hash: 43dde646e3a27e98346b089fb4d4dadea3319a22a17b89449fbdf8cc1896e164
                                          • Instruction Fuzzy Hash: 2A111F70304642EFC709DF70C458B9AFBF6BF88308F014A5CE46A87251CB35A819CB91
                                          Function 6A674270 Relevance: 7.5, APIs: 5, Instructions: 49timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??1QDateTime@@QAE@XZ.QT5CORE ref: 6A6742BE
                                          • ??1QDateTime@@QAE@XZ.QT5CORE ref: 6A6742C3
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6742C8
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6742D1
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A6742D9
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                            • Part of subcall function 6A6741C0: ??0QString@@QAE@XZ.QT5CORE(?,6A673FA5), ref: 6A6741C3
                                            • Part of subcall function 6A6741C0: ??0QString@@QAE@XZ.QT5CORE ref: 6A6741D3
                                            • Part of subcall function 6A6741C0: ??0QString@@QAE@XZ.QT5CORE ref: 6A6741DC
                                            • Part of subcall function 6A6741C0: ??0QDateTime@@QAE@XZ.QT5CORE ref: 6A6741F3
                                            • Part of subcall function 6A6741C0: ??0QDateTime@@QAE@XZ.QT5CORE ref: 6A6741FC
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$DateTime@@$malloc
                                          • String ID:
                                          • API String ID: 3822018753-0
                                          • Opcode ID: 5cbbe12ab80d76c5f4cb6bcbbef3f038fb71d4604ebc1e2ab5c90e74bacf741c
                                          • Instruction ID: a146eb639db75fc80e5868067786a46102cd3b91be763d9905695bcf4a7043b2
                                          • Opcode Fuzzy Hash: 5cbbe12ab80d76c5f4cb6bcbbef3f038fb71d4604ebc1e2ab5c90e74bacf741c
                                          • Instruction Fuzzy Hash: B60192B67102019BDB14DF65EC9CA16B3B8AF94215B018039E91ACB281DF70FC15CBA0
                                          Function 6A674300 Relevance: 7.5, APIs: 5, Instructions: 48timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(?,?,?,?,6A673FB2,00000000), ref: 6A674310
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(00000000,?,?,6A673FB2,00000000), ref: 6A67431F
                                          • ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(6A673FB2,?,?,6A673FB2,00000000), ref: 6A674328
                                          • ??4QDateTime@@QAEAAV0@ABV0@@Z.QT5CORE(?,?,?,6A673FB2,00000000), ref: 6A674343
                                          • ??4QDateTime@@QAEAAV0@ABV0@@Z.QT5CORE(?,?,?,6A673FB2,00000000), ref: 6A67434C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: V0@@$String@@$DateTime@@
                                          • String ID:
                                          • API String ID: 2599392857-0
                                          • Opcode ID: 99b5e9ee82297adbd98cf2c251b66192de356f4863c8d85ca8e3fe5fe3df10b9
                                          • Instruction ID: c737cb210b3cc23b208e3ade54bb2ec903a5b537ae7d9869111d3ab01cc972ed
                                          • Opcode Fuzzy Hash: 99b5e9ee82297adbd98cf2c251b66192de356f4863c8d85ca8e3fe5fe3df10b9
                                          • Instruction Fuzzy Hash: 80111FB5505696AFCB05CF69C8908A2BFF8BE2D100305429BD899C7647D724FA58CFE1
                                          Function 6A62A260 Relevance: 7.5, APIs: 5, Instructions: 38timeCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QMutex@@QAE@XZ.QT5CORE(00000000,?,?,?,?,?,?,?,?,?,?,?,6A629EEB,00000000,00000000,00000000), ref: 6A62A273
                                          • ??0QMutex@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,6A629EEB,00000000,00000000,00000000,?), ref: 6A62A27C
                                          • ??0QDateTime@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,6A629EEB,00000000,00000000,00000000,?), ref: 6A62A285
                                            • Part of subcall function 6A62A440: ??0QSharedData@@QAE@ABV0@@Z.QT5CORE(00000001,?,6A62A29B,?,?,?,?,?,?,?,?,?,?,?,6A629EEB,00000000), ref: 6A62A463
                                            • Part of subcall function 6A62A440: ??0QUrl@@QAE@ABV0@@Z.QT5CORE(00000005,?,?,?,?,?,?,?,?,?,?,?,6A629EEB,00000000,00000000,00000000), ref: 6A62A470
                                            • Part of subcall function 6A62A440: ??0QDateTime@@QAE@ABV0@@Z.QT5CORE(00000009,?,?,?,?,?,?,?,?,?,?,?,6A629EEB,00000000,00000000,00000000), ref: 6A62A47D
                                            • Part of subcall function 6A62A440: ??1QDateTime@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,6A629EEB,00000000,00000000,00000000,?), ref: 6A62A4A0
                                            • Part of subcall function 6A62A440: ??1QUrl@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,6A629EEB,00000000,00000000,00000000,?), ref: 6A62A4A9
                                          • ?setHost@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,6A629EEB,00000000,00000000), ref: 6A62A2A6
                                          • ??4QDateTime@@QAEAAV0@ABV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,6A629EEB,00000000,00000000,00000000), ref: 6A62A2BA
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DateTime@@V0@@$Url@@$Mutex@@$?setData@@Host@Mode@1@@ParsingSharedString@@malloc
                                          • String ID:
                                          • API String ID: 3955766937-0
                                          • Opcode ID: a2d8a1f6e0f17d4f84f24d4f2ec8c9fdb031c5e8e2693a011f1cd29e52d8938b
                                          • Instruction ID: 634c1c962e40159b7004dcbd4a8d357f13aa15c53a15b6e2643592269366256c
                                          • Opcode Fuzzy Hash: a2d8a1f6e0f17d4f84f24d4f2ec8c9fdb031c5e8e2693a011f1cd29e52d8938b
                                          • Instruction Fuzzy Hash: 820162B12002428FCB159F21C85CA6EBBB1EFE5315F09881DE48787292DF75A915CB52
                                          Function 6A6183F0 Relevance: 7.5, APIs: 5, Instructions: 36networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,00000000,?,?,?,00000000), ref: 6A6183FF
                                          • ??0QVariant@@QAE@ABVQByteArray@@@Z.QT5CORE(?,?,00000000,?,?,?,00000000), ref: 6A61840C
                                          • ?setAttribute@QNetworkRequest@@QAEXW4Attribute@1@ABVQVariant@@@Z.QT5NETWORK(0000000A,?,?,?,?,00000000), ref: 6A61841D
                                            • Part of subcall function 6A6218D0: ?isValid@QVariant@@QBE_NXZ.QT5CORE(?,00000000,?,00000000,6A615256,00000012,?), ref: 6A6218DC
                                            • Part of subcall function 6A6218D0: ?rehash@QHashData@@QAEXH@Z.QT5CORE(?,?,?,?,00000000,6A615256,00000012,?), ref: 6A62193A
                                            • Part of subcall function 6A6218D0: ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000008,?,?,?,00000000,6A615256,00000012,?), ref: 6A621957
                                            • Part of subcall function 6A6218D0: ??0QVariant@@QAE@ABV0@@Z.QT5CORE(6A615256,?,00000000,6A615256,00000012,?), ref: 6A621975
                                          • ??1QVariant@@QAE@XZ.QT5CORE(0000000A,?,?,?,?,00000000), ref: 6A618426
                                            • Part of subcall function 6A616A00: ?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPAU12@PBVQObject@@@Z.QT5CORE(?,?,?,6A6150E4,00000000), ref: 6A616A1E
                                            • Part of subcall function 6A616A00: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PBV1@PAPAX01PAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PBHPBU3@@Z.QT5CORE(?,?,?,?,00000000,00000000,00000000,00000000,?), ref: 6A616A9B
                                            • Part of subcall function 6A616A00: ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A616AAA
                                            • Part of subcall function 6A616A00: ?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PBV1@PAPAX01PAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PBHPBU3@@Z.QT5CORE(?,?,?,?,00000000,00000000,00000000,00000000,?), ref: 6A616AEE
                                            • Part of subcall function 6A616A00: ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A616AF7
                                            • Part of subcall function 6A616A00: ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2sslErrors(QList<QSslError>),?,1_q_replySslErrors(QList<QSslError>),00000000), ref: 6A616B19
                                            • Part of subcall function 6A616A00: ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A616B22
                                            • Part of subcall function 6A616A00: ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2preSharedKeyAuthenticationRequired(QSslPreSharedKeyAuthenticator*),?,1_q_replyPreSharedKeyAuthenticationRequired(QSslPreSharedKeyAuthenticator*),00000000), ref: 6A616B3D
                                            • Part of subcall function 6A616A00: ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A616B46
                                          • ??1QNetworkRequest@@QAE@XZ.QT5NETWORK(00000000,?,?,?,00000000), ref: 6A61844F
                                            • Part of subcall function 6A61FA20: ??1QSslConfiguration@@QAE@XZ.QT5NETWORK(?,?,6A6150ED,00000000), ref: 6A61FA5E
                                            • Part of subcall function 6A61FA20: ??1QHttp2Configuration@@QAE@XZ.QT5NETWORK(?,?,6A6150ED,00000000), ref: 6A61FA71
                                            • Part of subcall function 6A61FA20: ??1QString@@QAE@XZ.QT5CORE(?,?,6A6150ED,00000000), ref: 6A61FA79
                                            • Part of subcall function 6A61FA20: ??1QUrl@@QAE@XZ.QT5CORE(?,?,6A6150ED,00000000), ref: 6A61FA82
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$Connection@Meta$ConnectionType@Variant@@$?connect?connect@Base@Configuration@@Data@@HashImpl@NetworkObjectPrivate@@Qt@@Qt@@@Request@@SharedSlotU3@@V0@@$?allocate?get?rehash@?setArray@@@Attribute@Attribute@1@Authenticator@@ByteCountData@ExternalHttp2Node@Object@@@Pointer@@Ref@String@@U12@Url@@Valid@Variant@@@
                                          • String ID:
                                          • API String ID: 723342442-0
                                          • Opcode ID: 176486b0d3a8d4dcd53b306134ff9f5bcfe9f56f1d805e25b50bd00abb07339e
                                          • Instruction ID: e811878f241a536bb8a27ac9482a7973fe20491aeb793c924afcf0c9cdbc7942
                                          • Opcode Fuzzy Hash: 176486b0d3a8d4dcd53b306134ff9f5bcfe9f56f1d805e25b50bd00abb07339e
                                          • Instruction Fuzzy Hash: 86F04B76208211ABC704DB55C898DAEBBB5FF98218F01491DF48A93160EB35AE19CB56
                                          Function 6A660830 Relevance: 7.5, APIs: 5, Instructions: 30networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(00000000), ref: 6A66084A
                                          • ??1QNetworkInterface@@QAE@XZ.QT5NETWORK(00000000), ref: 6A660853
                                          • ??0QNetworkProxyQuery@@QAE@XZ.QT5NETWORK ref: 6A660863
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(00000000), ref: 6A66086B
                                          • ??1QNetworkInterface@@QAE@XZ.QT5NETWORK(00000000), ref: 6A660874
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Network$Authenticator@@Interface@@SharedV0@@$ProxyQuery@@
                                          • String ID:
                                          • API String ID: 3782148798-0
                                          • Opcode ID: f4d0348ff1d513eb328fd5441c98f26111c010c5a69a6c4ca603cee2b2c7bab6
                                          • Instruction ID: ae61b2840188b057e1879abd2437db82fc3949f2787d5bc459deca3cbe42d741
                                          • Opcode Fuzzy Hash: f4d0348ff1d513eb328fd5441c98f26111c010c5a69a6c4ca603cee2b2c7bab6
                                          • Instruction Fuzzy Hash: DCF0A0323141209B8608E759D8548AFB3A8AF94A1AB15D46DF20BC7541CF30AC00C7AA
                                          Function 6A65C960 Relevance: 7.5, APIs: 5, Instructions: 30networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??4QSslConfiguration@@QAEAAV0@ABV0@@Z.QT5NETWORK(?), ref: 6A65C975
                                          • ?request@QNetworkReply@@QBE?AVQNetworkRequest@@XZ.QT5NETWORK(?), ref: 6A65C986
                                          • ?sslConfiguration@QNetworkRequest@@QBE?AVQSslConfiguration@@XZ.QT5NETWORK(?), ref: 6A65C992
                                          • ??1QSslConfiguration@@QAE@XZ.QT5NETWORK(?), ref: 6A65C9A7
                                          • ??1QNetworkRequest@@QAE@XZ.QT5NETWORK(?), ref: 6A65C9B0
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Network$Configuration@@Request@@$?request@?sslConfiguration@Reply@@V0@@
                                          • String ID:
                                          • API String ID: 1510235176-0
                                          • Opcode ID: 537737e8ccdf07f462bb3afdaf80b9710e532449295808635be31dde457da56e
                                          • Instruction ID: e9d7e9adc550f75ec5178187304216f38c366fc0a2336ef77aa148db04da91a4
                                          • Opcode Fuzzy Hash: 537737e8ccdf07f462bb3afdaf80b9710e532449295808635be31dde457da56e
                                          • Instruction Fuzzy Hash: 69F05E76614201AFC704EF64D898C9BB7A8BF95704F418469E94A47251EF30E918CBA5
                                          Function 6A674220 Relevance: 7.5, APIs: 5, Instructions: 21timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??1QDateTime@@QAE@XZ.QT5CORE ref: 6A674231
                                          • ??1QDateTime@@QAE@XZ.QT5CORE ref: 6A67423A
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A674243
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A67424C
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A674254
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$DateTime@@
                                          • String ID:
                                          • API String ID: 1669668222-0
                                          • Opcode ID: a898ba8da954e6c83eb47e0ad12e6559100fc4ac39a31b26a50b86533838104e
                                          • Instruction ID: 8e9419989afb3f21de7ac1aaf44749d65af64b5ffcf2de64efc0e4de70f9bcc9
                                          • Opcode Fuzzy Hash: a898ba8da954e6c83eb47e0ad12e6559100fc4ac39a31b26a50b86533838104e
                                          • Instruction Fuzzy Hash: 5CE0487510040A9BDB059F21E95CA28B7B5FFA63067128218E41BC2695EF31FD57CF81
                                          Function 6A672BE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A673210: ?lock@QMutex@@QAEXXZ.QT5CORE(?,?,6BB6C190,6BBE0EA0,?,?,?,?,?,6A6738E1,?,?,?,?,6BB6C190,6BBE0EA0), ref: 6A673221
                                            • Part of subcall function 6A673210: ??0QHostAddress@@QAE@XZ.QT5NETWORK(?,?,6BB6C190,6BBE0EA0,?,?,?,?,?,6A6738E1,?,?,?,?,6BB6C190,6BBE0EA0), ref: 6A673239
                                            • Part of subcall function 6A673210: ??0QUrl@@QAE@ABV0@@Z.QT5CORE(-00000004,?,?,6BB6C190,6BBE0EA0,?,?,?,?,?,6A6738E1,?,?,?,?,6BB6C190), ref: 6A673250
                                            • Part of subcall function 6A673210: ??1QUrl@@QAE@XZ.QT5CORE(?,?,?,?,?,6A6738E1,?,?,?,?,6BB6C190,6BBE0EA0,?,6A6182E9,?,?), ref: 6A673282
                                            • Part of subcall function 6A673210: ?host@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(?,?,?,?,?,?,?,6A6738E1,?,?,?,?,6BB6C190,6BBE0EA0,?,6A6182E9), ref: 6A673296
                                            • Part of subcall function 6A673210: ??1QUrl@@QAE@XZ.QT5CORE(?,?,?,?,?,?,6A6738E1,?,?,?,?,6BB6C190,6BBE0EA0,?,6A6182E9,?), ref: 6A6732A0
                                            • Part of subcall function 6A673210: ??8QString@@QBE_NVQLatin1String@@@Z.QT5CORE(00000009,localhost,?,?,?,?,?,?,6A6738E1,?,?,?,?,6BB6C190,6BBE0EA0), ref: 6A6732AD
                                            • Part of subcall function 6A673210: ?startsWith@QString@@QBE_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z.QT5CORE(0000000A,localhost.,00000001,?,?,?,?,?,?,6A6738E1,?,?,?,?,6BB6C190,6BBE0EA0), ref: 6A6732C8
                                            • Part of subcall function 6A673210: ?setAddress@QHostAddress@@QAE_NABVQString@@@Z.QT5NETWORK(?,?,?,?,?,?,?,6A6738E1,?,?,?,?,6BB6C190,6BBE0EA0,?,6A6182E9), ref: 6A6732DF
                                            • Part of subcall function 6A673210: ?isLoopback@QHostAddress@@QBE_NXZ.QT5NETWORK(?,?,?,?,?,?,?,6A6738E1,?,?,?,?,6BB6C190,6BBE0EA0,?,6A6182E9), ref: 6A6732EC
                                            • Part of subcall function 6A673210: ??1QString@@QAE@XZ.QT5CORE(?,?,?,?,?,?,6A6738E1,?,?,?,?,6BB6C190,6BBE0EA0,?,6A6182E9,?), ref: 6A67342B
                                            • Part of subcall function 6A673210: ??1QHostAddress@@QAE@XZ.QT5NETWORK(?,?,?,?,?,?,6A6738E1,?,?,?,?,6BB6C190,6BBE0EA0,?,6A6182E9,?), ref: 6A673435
                                            • Part of subcall function 6A673210: ?unlock@QMutexLocker@@QAEXXZ.QT5CORE(?,?,?,?,?,?,6A6738E1,?,?,?,?,6BB6C190,6BBE0EA0,?,6A6182E9,?), ref: 6A673447
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(?,?,?,00000000,?), ref: 6A672C75
                                          • ??1QUrl@@QAE@XZ.QT5CORE ref: 6A672C98
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@Url@@$Address@@Host$Latin1String@@@$?dispose@?host@?lock@?set?starts?unlock@Address@CaseComponentData@1@@Data@@Flags@FormattingListLocker@@Loopback@MutexMutex@@Option@Qt@@@Sensitivity@Url@@@@@V0@@With@
                                          • String ID: L.pj$L.pj
                                          • API String ID: 2577254483-576494805
                                          • Opcode ID: 25e1bc36ea3a51fa568f5946b835eba38c9bf18353e8cb291692ad6d99603ba1
                                          • Instruction ID: 72c5783845d70441e97783012e12f58b59351ae3882df9ac646a1c7b777d76b3
                                          • Opcode Fuzzy Hash: 25e1bc36ea3a51fa568f5946b835eba38c9bf18353e8cb291692ad6d99603ba1
                                          • Instruction Fuzzy Hash: A121AE712147018FD761DF68DC40A5AB3E8FF85324F064898E8A6DB351DF31E909CBA2
                                          Function 6A6483A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2timeout(),?,1_q_connectDelayedChannel(),00000000,?,?,?,?,?,?,?,?,?,?), ref: 6A648449
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE ref: 6A648456
                                            • Part of subcall function 6A64DFB0: ?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPAU12@PBVQObject@@@Z.QT5CORE(?,?,?,6A6483C4,?,?,?,?,?,?,6A645F4B), ref: 6A64DFBD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object@@$Connection@Meta$?connect@?getConnectionCountData@ExternalObject@@@Pointer@@Qt@@@Ref@SharedType@U12@
                                          • String ID: 1_q_connectDelayedChannel()$2timeout()
                                          • API String ID: 535252372-522021296
                                          • Opcode ID: d9248881cedbd38a0a78fa503d1bdeb2ba373d457ea7b82931c67aac2ed4327c
                                          • Instruction ID: 5c89bbfda028f7680946c137815726a61cd46cbb5dde12cd07579786efe786c2
                                          • Opcode Fuzzy Hash: d9248881cedbd38a0a78fa503d1bdeb2ba373d457ea7b82931c67aac2ed4327c
                                          • Instruction Fuzzy Hash: 0E219FB1600B06AFC314CFA8C884A96B7B4FF45314B15C129E96A83691DB35F826CFD5
                                          Function 6A62C870 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A62CAE0: ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,6A62C890), ref: 6A62CB4C
                                            • Part of subcall function 6A6132C0: ??1QString@@QAE@XZ.QT5CORE(00000000,6A6D0084,00000000,6A694819), ref: 6A613305
                                            • Part of subcall function 6A6132C0: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,00000000,6A6D0084,00000000,6A694819), ref: 6A613310
                                          • ?startsWith@QString@@QBE_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z.QT5CORE(00000005,STOR ,00000001), ref: 6A62C8E6
                                          • ?write@QIODevice@@QAE_JPBD_J@Z.QT5CORE(ABOR,00000006,00000000), ref: 6A62C909
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$?dispose@?starts?write@Array@@ByteCaseData@1@@Data@@Device@@Latin1ListQt@@@Sensitivity@With@
                                          • String ID: ABOR$STOR
                                          • API String ID: 2532516760-1033067953
                                          • Opcode ID: b208b1eeb579cf1925daa7f1e44b3ddfcc3100ac0f3658b69f5cd7607a6402fb
                                          • Instruction ID: b3c0f5b99f4ab5b6a95c25957095c93509049d3308f2f33dc6ed191139f6c2cf
                                          • Opcode Fuzzy Hash: b208b1eeb579cf1925daa7f1e44b3ddfcc3100ac0f3658b69f5cd7607a6402fb
                                          • Instruction Fuzzy Hash: 6E214934945B408FFB20CB28C599B97BBE0AF05305F01891CDAAB47791DB75F888CB91
                                          Function 6A69E350 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?write@QIODevice@@QAE_JPBD_J@Z.QT5CORE(?,?,?), ref: 6A69E37F
                                          • ?append@QRingBuffer@@QAEXPBD_J@Z.QT5CORE(?,?,?), ref: 6A69E399
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(?,_q_flushWriteBuffer,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6A69E3E6
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: GenericObject@@$?append@?invoke?write@Argument@@Argument@@444444444@Buffer@@ConnectionDevice@@MetaMethod@Qt@@ReturnRingType@
                                          • String ID: _q_flushWriteBuffer
                                          • API String ID: 1592484091-1654437940
                                          • Opcode ID: 2fc44c86e5ae4d15ad6b27084f3dfa289a35a963783be75acef89b7308bb0f85
                                          • Instruction ID: d1ffa311153d29da016c549fea2588d80cc99fd433b14f96babba087f91f2bdd
                                          • Opcode Fuzzy Hash: 2fc44c86e5ae4d15ad6b27084f3dfa289a35a963783be75acef89b7308bb0f85
                                          • Instruction Fuzzy Hash: BB012C71108342DFD711CF64D908F8ABBF6BB85701F04481DF196A2191C7719C68DB62
                                          Function 6A696B60 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWarningEnabled@QLoggingCategory@@QBE_NXZ.QT5CORE ref: 6A696B73
                                            • Part of subcall function 6A6931B0: ??0QLoggingCategory@@QAE@PBD@Z.QT5CORE(qt.network.ssl,6A6A4C21), ref: 6A6931F2
                                            • Part of subcall function 6A6931B0: __Init_thread_footer.LIBCMT ref: 6A693207
                                          • ??0QMessageLogger@@QAE@PBDH00@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A696B8F
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QSslConfiguration::setPeerVerifyDepth: cannot set negative depth of %d,?), ref: 6A696B9C
                                          Strings
                                          • QSslConfiguration::setPeerVerifyDepth: cannot set negative depth of %d, xrefs: 6A696B96
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Category@@Logger@@LoggingMessage$?warning@Enabled@H00@Init_thread_footerWarning
                                          • String ID: QSslConfiguration::setPeerVerifyDepth: cannot set negative depth of %d
                                          • API String ID: 646154281-4135051324
                                          • Opcode ID: f204fc32c33832aa4621aef299af2e1cf2eeeb7250674d56830e36c22e9e461d
                                          • Instruction ID: 28974f0aa3524f9300c6fbd021c0e9d844c88177c5bf0d802cd409ca8644bd43
                                          • Opcode Fuzzy Hash: f204fc32c33832aa4621aef299af2e1cf2eeeb7250674d56830e36c22e9e461d
                                          • Instruction Fuzzy Hash: 57F0ECF55002115BCE00BBA54C09B477FB4AF44715F434054F64A5B266DF319414C7E9
                                          Function 6A664260 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?normalizedType@QMetaObject@@SA?AVQByteArray@@PBD@Z.QT5CORE(?,QNetworkConfigurationPrivatePointer,?,00000000,6A661567), ref: 6A664277
                                          • ?registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAX1PBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z.QT5CORE(?,6A662640), ref: 6A66429D
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,6A661567), ref: 6A6642AC
                                          Strings
                                          • QNetworkConfigurationPrivatePointer, xrefs: 6A664271
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Meta$Array@@Byte$Type@$?normalized?registerFlag@Flags@NormalizedObject@@Object@@@TypeType@@Type@@@@
                                          • String ID: QNetworkConfigurationPrivatePointer
                                          • API String ID: 1134406281-264861295
                                          • Opcode ID: 9b56c5e54a9c8f379af01d3a1e5e6cdd3bfd871afa8d50df87ca18b87f93e5a1
                                          • Instruction ID: 7ae9955a8b162f761db75b746fa9172db4d1f2813e76f8c7e6f26955e0a2790d
                                          • Opcode Fuzzy Hash: 9b56c5e54a9c8f379af01d3a1e5e6cdd3bfd871afa8d50df87ca18b87f93e5a1
                                          • Instruction Fuzzy Hash: AEF065B5904311EBDB00DFB5CD59F457BF8BB15B05F404469FA86D3140EB74E9048B9A
                                          Function 6A660A50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?normalizedType@QMetaObject@@SA?AVQByteArray@@PBD@Z.QT5CORE(?,QNetworkConfiguration,?,00000000,6A661567), ref: 6A660A67
                                          • ?registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAX1PBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z.QT5CORE(?,6A6604E0), ref: 6A660A8D
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,6A661567), ref: 6A660A9C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Meta$Array@@Byte$Type@$?normalized?registerFlag@Flags@NormalizedObject@@Object@@@TypeType@@Type@@@@
                                          • String ID: QNetworkConfiguration
                                          • API String ID: 1134406281-1564969325
                                          • Opcode ID: c67f652c199c94b9463ab007362c36d6425ee4f6addc3a6427bb61216a41ff30
                                          • Instruction ID: 5505964638b55894f5f8da4d7198394611149abf8fa8be6ee9d41eb2ad9141e5
                                          • Opcode Fuzzy Hash: c67f652c199c94b9463ab007362c36d6425ee4f6addc3a6427bb61216a41ff30
                                          • Instruction Fuzzy Hash: 63F037B5904300EBDB10DB64CC49B5A7AF8BB05745F414469FB55D2180EF74A9448696
                                          Function 6A660AB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?normalizedType@QMetaObject@@SA?AVQByteArray@@PBD@Z.QT5CORE(?,QNetworkSession::SessionError,?,6A660169,?,?,?,?,?,?,?,6A665AF5,?,00000000,00000000), ref: 6A660AC7
                                          • ?registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAX1PBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z.QT5CORE(?,?), ref: 6A660AED
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000), ref: 6A660AFC
                                          Strings
                                          • QNetworkSession::SessionError, xrefs: 6A660AC1
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Meta$Array@@Byte$Type@$?normalized?registerFlag@Flags@NormalizedObject@@Object@@@TypeType@@Type@@@@
                                          • String ID: QNetworkSession::SessionError
                                          • API String ID: 1134406281-3125804625
                                          • Opcode ID: dc2209155dc1250f7b74fc47463c59d8f2e168efa923c1319332961b4620362b
                                          • Instruction ID: 23facb00e62051420c2cb41527eb28dc407bd298a4f553a7948dcd0710199331
                                          • Opcode Fuzzy Hash: dc2209155dc1250f7b74fc47463c59d8f2e168efa923c1319332961b4620362b
                                          • Instruction Fuzzy Hash: 19F030B1544300ABDB10DFA88D59F8A7BF8BB09B09F404469FB46D2240EF349D048BE5
                                          Function 6A69C330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?normalizedType@QMetaObject@@SA?AVQByteArray@@PBD@Z.QT5CORE(?,QSslCertificate,?,?,6A6998E7), ref: 6A69C347
                                          • ?registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAX1PBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z.QT5CORE(?,6A69A1D0), ref: 6A69C36D
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,6A6998E7), ref: 6A69C37C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Meta$Array@@Byte$Type@$?normalized?registerFlag@Flags@NormalizedObject@@Object@@@TypeType@@Type@@@@
                                          • String ID: QSslCertificate
                                          • API String ID: 1134406281-1564084169
                                          • Opcode ID: 61620b38498bcc298d06549acaf06b23117ba72599f64052f6d298bb8b6aab9e
                                          • Instruction ID: a462bffad87a9c56db7e191c4aefc326d785d8fcdfc48f2e0c12712ed9084947
                                          • Opcode Fuzzy Hash: 61620b38498bcc298d06549acaf06b23117ba72599f64052f6d298bb8b6aab9e
                                          • Instruction Fuzzy Hash: B7F065B5904301ABDB00DB75DD49F467FF8BB45785F400419FA46E2180EF74B908CBA5
                                          Function 6A66E0E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?normalizedType@QMetaObject@@SA?AVQByteArray@@PBD@Z.QT5CORE(?,QHostInfo), ref: 6A66E0F7
                                          • ?registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAX1PBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z.QT5CORE(?,6A66C780), ref: 6A66E11D
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A66E12C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Meta$Array@@Byte$Type@$?normalized?registerFlag@Flags@NormalizedObject@@Object@@@TypeType@@Type@@@@
                                          • String ID: QHostInfo
                                          • API String ID: 1134406281-3485326554
                                          • Opcode ID: 0fe6c1241f7dcd27ba825faa601b0b1017e740cc5671ad0df058c9b8e3f5d0bc
                                          • Instruction ID: e5c6448816a9f618ebad4b9ac3554dbce95d2bf9c7fff9917295bee3ca9b886f
                                          • Opcode Fuzzy Hash: 0fe6c1241f7dcd27ba825faa601b0b1017e740cc5671ad0df058c9b8e3f5d0bc
                                          • Instruction Fuzzy Hash: A4F030B5A44300ABDF00DB65CC49F4A7AF8BB05745F444529FA86D2240EB74B9048B9A
                                          Function 6A684240 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isValid@QAbstractSocket@@QBE_NXZ.QT5NETWORK ref: 6A684246
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A684259
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QUdpSocket::hasPendingDatagrams() called on a QUdpSocket when not in QUdpSocket::BoundState), ref: 6A684265
                                          Strings
                                          • QUdpSocket::hasPendingDatagrams() called on a QUdpSocket when not in QUdpSocket::BoundState, xrefs: 6A68425F
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?warning@AbstractSocket@@Valid@
                                          • String ID: QUdpSocket::hasPendingDatagrams() called on a QUdpSocket when not in QUdpSocket::BoundState
                                          • API String ID: 4147375848-757159223
                                          • Opcode ID: d45f5a8f084e866f7982a743a34c58df5044320912b02db83b2073937a3189b9
                                          • Instruction ID: fb7e01de8b5146df70a9577349e83c47d54c5db5d368b8e5d42586d0fe8998cf
                                          • Opcode Fuzzy Hash: d45f5a8f084e866f7982a743a34c58df5044320912b02db83b2073937a3189b9
                                          • Instruction Fuzzy Hash: C1E092B0650210ABDA10FB2CCC49FC273F8AF06704F560495E956D7292EB61E81486B6
                                          Function 6A6843E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isValid@QAbstractSocket@@QBE_NXZ.QT5NETWORK ref: 6A6843E6
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A6843F9
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QUdpSocket::leaveMulticastGroup() called on a QUdpSocket when not in QUdpSocket::BoundState), ref: 6A684405
                                          Strings
                                          • QUdpSocket::leaveMulticastGroup() called on a QUdpSocket when not in QUdpSocket::BoundState, xrefs: 6A6843FF
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?warning@AbstractSocket@@Valid@
                                          • String ID: QUdpSocket::leaveMulticastGroup() called on a QUdpSocket when not in QUdpSocket::BoundState
                                          • API String ID: 4147375848-2614186080
                                          • Opcode ID: 8b86ced5ac00a587e9264b1ef5c25acd8c6829c061dc9ecf1f4de8c1a66457bd
                                          • Instruction ID: d16d5473d554d76a814721f06c7dc806ea0a415751fb9e30d44a656df946f496
                                          • Opcode Fuzzy Hash: 8b86ced5ac00a587e9264b1ef5c25acd8c6829c061dc9ecf1f4de8c1a66457bd
                                          • Instruction Fuzzy Hash: 97E092B05502109BDA10FB1CCD49FC237B8AF06704F5204A5EA47E7292DB61F82887B6
                                          Function 6A684310 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isValid@QAbstractSocket@@QBE_NXZ.QT5NETWORK ref: 6A684317
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68432A
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QUdpSocket::joinMulticastGroup() called on a QUdpSocket when not in QUdpSocket::BoundState), ref: 6A684336
                                          Strings
                                          • QUdpSocket::joinMulticastGroup() called on a QUdpSocket when not in QUdpSocket::BoundState, xrefs: 6A684330
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?warning@AbstractSocket@@Valid@
                                          • String ID: QUdpSocket::joinMulticastGroup() called on a QUdpSocket when not in QUdpSocket::BoundState
                                          • API String ID: 4147375848-868601650
                                          • Opcode ID: 5fffcfa787f95235ed4454d7ce85bc2f80ec3f0fbc55773ecef235ef0e9e1af2
                                          • Instruction ID: 96a018c6441f29e217fdd9423cc98c4fff9fe1492584382128db65d6ee70d94f
                                          • Opcode Fuzzy Hash: 5fffcfa787f95235ed4454d7ce85bc2f80ec3f0fbc55773ecef235ef0e9e1af2
                                          • Instruction Fuzzy Hash: C5E092B1550210ABDA10FB1CCC06FC277B8AF17305F520495E543E7192DB62B81487B6
                                          Function 6A68C160 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Unsupported socket operation,00000000,000000FF), ref: 6A68C189
                                          • ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(?), ref: 6A68C197
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 6A68C1A1
                                          Strings
                                          • Unsupported socket operation, xrefs: 6A68C16F
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$?tr@DateMetaObject@@Time@@V0@$$V0@@
                                          • String ID: Unsupported socket operation
                                          • API String ID: 691198089-3713901071
                                          • Opcode ID: af9973ddc7e05f20a07db3588bf478bc3d2e99450f835537df195098af414d58
                                          • Instruction ID: 359ec3bd98b5870a066837c3f84fb516286985954be99825173aabc53068d955
                                          • Opcode Fuzzy Hash: af9973ddc7e05f20a07db3588bf478bc3d2e99450f835537df195098af414d58
                                          • Instruction Fuzzy Hash: 9AF0A0B0009340AFDB50CB10CA48F83BBF8BF52310F40660DF08392980CB70B8498B51
                                          Function 6A684840 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isValid@QAbstractSocket@@QBE_NXZ.QT5NETWORK ref: 6A684847
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68485A
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QUdpSocket::setMulticastInterface() called on a QUdpSocket when not in QUdpSocket::BoundState), ref: 6A684866
                                          Strings
                                          • QUdpSocket::setMulticastInterface() called on a QUdpSocket when not in QUdpSocket::BoundState, xrefs: 6A684860
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?warning@AbstractSocket@@Valid@
                                          • String ID: QUdpSocket::setMulticastInterface() called on a QUdpSocket when not in QUdpSocket::BoundState
                                          • API String ID: 4147375848-2078465190
                                          • Opcode ID: d041fce5fdbe402370269cc5f0ca7a077cebc6be71bb89aead70047bf73da0c0
                                          • Instruction ID: 50d50d2599c0dc588de65ebc9d58b9d451c87d35e7a14ef1253a6fb7d5908696
                                          • Opcode Fuzzy Hash: d041fce5fdbe402370269cc5f0ca7a077cebc6be71bb89aead70047bf73da0c0
                                          • Instruction Fuzzy Hash: 8DE092B1550200EBDA10EB1CCC05B827378AF05215F5244A5E512A7182DB62F41486B6
                                          Function 6A69C160 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?lock@QMutex@@QAEXXZ.QT5CORE ref: 6A69C179
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE(?), ref: 6A69C1A0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?lock@?unlock@Locker@@MutexMutex@@
                                          • String ID: p/pj$p/pj
                                          • API String ID: 914300419-2647425699
                                          • Opcode ID: 4a8dcebc6ee319178c74dbf98f3773819542c447b6005d3b5339e382fb94e0b5
                                          • Instruction ID: f84bd7013e149377f1b59eb1afef437db81080ce9873826a1bedaf0efc40d0a3
                                          • Opcode Fuzzy Hash: 4a8dcebc6ee319178c74dbf98f3773819542c447b6005d3b5339e382fb94e0b5
                                          • Instruction Fuzzy Hash: 19E012B25042029FC708EB74C55C56EBBE5AF44248F02085CE4C3CB256CF34F800CB56
                                          Function 6A660B10 Relevance: 6.2, APIs: 4, Instructions: 169networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?stateChanged@QNetworkSession@@QAEXW4State@1@@Z.QT5NETWORK(?,6A6609E1,?,?,00000000,?), ref: 6A660B3D
                                          • ?error@QNetworkSession@@QAEXW4SessionError@1@@Z.QT5NETWORK(?,?,6A6609E1,?,?,00000000,?), ref: 6A660B8C
                                          • ?preferredConfigurationChanged@QNetworkSession@@QAEXABVQNetworkConfiguration@@_N@Z.QT5NETWORK(?,?,?,6A6609E1,?,?,00000000,?), ref: 6A660BA4
                                          • ?usagePoliciesChanged@QNetworkSession@@QAEXV?$QFlags@W4UsagePolicy@QNetworkSession@@@@@Z.QT5NETWORK(?,?,6A6609E1,?,?,00000000,?), ref: 6A660BD5
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Network$Session@@$Changed@$?error@?preferred?state?usageConfigurationConfiguration@@_Error@1@@Flags@PoliciesPolicy@SessionSession@@@@@State@1@@Usage
                                          • String ID:
                                          • API String ID: 784443773-0
                                          • Opcode ID: c302fe09b40a0753e6936c1eea9db5a8fd83c28be16e2eeb3dd0b88ac87368c1
                                          • Instruction ID: f8ed9e95edee7a7b240291d3bdd61a6e3c7d5b2e2d7b5a9095a97c2b2e1c4332
                                          • Opcode Fuzzy Hash: c302fe09b40a0753e6936c1eea9db5a8fd83c28be16e2eeb3dd0b88ac87368c1
                                          • Instruction Fuzzy Hash: 62610078209201DFD705CF14C190A5AB7F1BF89715F96A8ACE4998B3A1CB75EC44DF02
                                          Function 6A64E090 Relevance: 6.2, APIs: 4, Instructions: 150COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?realloc@QListData@@QAEXH@Z.QT5CORE(00000000,?,6A63FD19,00000000,?), ref: 6A64E0CA
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(?,00000001), ref: 6A64E121
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(6A63FD19,?,?,6A63FD19,00000000,?), ref: 6A64E1C9
                                            • Part of subcall function 6A64C5F0: ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(6A64E0C5,?,?,?,6A64E0C5,00000000,?,6A63FD19,00000000,?), ref: 6A64C604
                                          • ?nextNode@QMapNodeBase@@QBEPBU1@XZ.QT5CORE(?), ref: 6A64E1F3
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@List$Data@1@$?append@?detach@?detach_grow@?next?realloc@Base@@NodeNode@
                                          • String ID:
                                          • API String ID: 2060292595-0
                                          • Opcode ID: 520d9d3d46855c490e5595ca0d8898bca3e2a59fc842e225305596505b734c8a
                                          • Instruction ID: e6719afef4bb9d28be9d1c6d96f2bec9881a2aa30be1f4e0d6605fb52a104565
                                          • Opcode Fuzzy Hash: 520d9d3d46855c490e5595ca0d8898bca3e2a59fc842e225305596505b734c8a
                                          • Instruction Fuzzy Hash: 1551D7757002008FCB14CF58D880A6A73F5FF85314B19856DE616CB382DB35ED29CBA1
                                          Function 6A662080 Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                                          Download Yara Rule
                                          APIs
                                          • memmove.VCRUNTIME140(00000000,?,0000000F,0000000F,?,?,6BB044C0,?), ref: 6A6620F2
                                          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?), ref: 6A66216B
                                          • __std_exception_copy.VCRUNTIME140(?,?,?,?), ref: 6A6621C1
                                          • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6A6621F7
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copymemmove
                                          • String ID:
                                          • API String ID: 908738561-0
                                          • Opcode ID: de556f2b6c0cac3eaa12c237d32101a21581a2a249e296032042e514f841028e
                                          • Instruction ID: ad6951ec0ab78066786ee36486dd1ccf38f8fb5052c1e89bb32ec33d6b6beced
                                          • Opcode Fuzzy Hash: de556f2b6c0cac3eaa12c237d32101a21581a2a249e296032042e514f841028e
                                          • Instruction Fuzzy Hash: B0516572A183409BC704CF68C88496AF7E5FFC9304F408A5DF99597252EB71EA90CB97
                                          Function 6A66CA60 Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(00000001,00000001,?,00000000), ref: 6A66CA9C
                                            • Part of subcall function 6A66DDC0: ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,?), ref: 6A66DDE4
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,00000000), ref: 6A66CB34
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?,00000000), ref: 6A66CB44
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A66CB5C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Authenticator@@SharedV0@@$Data@@List$?append@?detach_grow@Data@1@
                                          • String ID:
                                          • API String ID: 4176725997-0
                                          • Opcode ID: 876329a0419b1fae4b87c0c71dd348440013897b089c30a5773643477eb431cc
                                          • Instruction ID: 1fa2329cdb1d6dd5ddae84a8c369fed5e44de6a90d30d46c672f9066d7c90755
                                          • Opcode Fuzzy Hash: 876329a0419b1fae4b87c0c71dd348440013897b089c30a5773643477eb431cc
                                          • Instruction Fuzzy Hash: 2C3192B16042059BDB00DF68DC40A6A73A5FF81718F15452CEA16DB382DB32FD29CB96
                                          Function 6A66CB70 Relevance: 6.1, APIs: 4, Instructions: 85COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??1QString@@QAE@XZ.QT5CORE(?,6BD7498C,6BAFB7C0,?,6A66CDFB), ref: 6A66CB90
                                          • ??1QString@@QAE@XZ.QT5CORE(6BD74994,?,6BD7498C,6BAFB7C0,?,6A66CDFB), ref: 6A66CBBE
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(Function_00006160,?,6BD7498C,6BAFB7C0,?,6A66CDFB), ref: 6A66CC17
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(Function_00006160,?,6BD7498C,6BAFB7C0,?,6A66CDFB), ref: 6A66CC3B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?free_helper@Data@@HashNode@1@@String@@
                                          • String ID:
                                          • API String ID: 1644168457-0
                                          • Opcode ID: 06760f7f38396499873f77951cb3301e5492974e35de4bf68ee2fbb313e17ddb
                                          • Instruction ID: d1a880eb385f3e6381a363a08aa00a0503a29a4ded07a03fb17c0e01de16dbbe
                                          • Opcode Fuzzy Hash: 06760f7f38396499873f77951cb3301e5492974e35de4bf68ee2fbb313e17ddb
                                          • Instruction Fuzzy Hash: 6321C774201A068BDF008F6AD8C0F1573B4AF427657164298E82ADB2D1EF31FC56CB92
                                          Function 6A66C210 Relevance: 6.1, APIs: 4, Instructions: 76COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?lock@QMutex@@QAEXXZ.QT5CORE ref: 6A66C22F
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE ref: 6A66C2C5
                                            • Part of subcall function 6A62D160: ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(?,?,00000000,?,6A671114,?,?,?,6A670568,00000000,?,00000000,?,?,6BB6C190,?), ref: 6A62D182
                                            • Part of subcall function 6A62D160: memmove.VCRUNTIME140(?,00000000,00000000,?,6A670568,00000000,?,00000000,?,?,6BB6C190,?,?,6BB6C190,?), ref: 6A62D1B4
                                            • Part of subcall function 6A62D160: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,?,6A670568,00000000,?,00000000,?,?,6BB6C190,?,?,6BB6C190,?,?,?,?), ref: 6A62D1D6
                                          • ?remove@QListData@@QAEXH@Z.QT5CORE(-00000004), ref: 6A66C29E
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE ref: 6A66C2D8
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@List$?append@?detach@?dispose@?lock@?remove@?unlock@Data@1@Data@1@@Locker@@MutexMutex@@memmove
                                          • String ID:
                                          • API String ID: 2876832588-0
                                          • Opcode ID: a28989029e7d820ffda3a189b7968a30f34cd0eee9f27e7451afd219637c0ad4
                                          • Instruction ID: 58ada44c0a0b533087aa6b3562953a1396c645fa4958c02389f47c3eb240a317
                                          • Opcode Fuzzy Hash: a28989029e7d820ffda3a189b7968a30f34cd0eee9f27e7451afd219637c0ad4
                                          • Instruction Fuzzy Hash: 8F21E0725005128BDF14CFE8C884AA9B7A8BF86314B176269DC57D7292DF30FC85CB92
                                          Function 6A664B00 Relevance: 6.1, APIs: 4, Instructions: 71COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A664C30: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A664EE0,?,?,?,?,6A664B15,?), ref: 6A664C7A
                                            • Part of subcall function 6A664C30: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A664EE0,?,?,?,?,6A664B15,?), ref: 6A664C9F
                                            • Part of subcall function 6A664C30: ?clear@QString@@QAEXXZ.QT5CORE(?,?,?,?,6A664B15,?), ref: 6A664CED
                                            • Part of subcall function 6A664C30: ?nextNode@QHashData@@SAPAUNode@1@PAU21@@Z.QT5CORE(?,?,?,?,?,6A664B15,?), ref: 6A664CF4
                                            • Part of subcall function 6A664C30: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A664EE0,?,?,?,?,6A664B15,?), ref: 6A664D29
                                          • ??1QRecursiveMutex@@QAE@XZ.QT5CORE ref: 6A664B2D
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A664EE0), ref: 6A664B60
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A664EE0), ref: 6A664B88
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A664EE0), ref: 6A664BAF
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@Hash$?free_helper@Node@1@@$?clear@?nextMutex@@Node@Node@1@RecursiveString@@U21@@
                                          • String ID:
                                          • API String ID: 3782720226-0
                                          • Opcode ID: 2543abcbf31cc243ec37774c27c533e7a2c59fbfae1390a619607f6781a879b3
                                          • Instruction ID: dff010ef48dc4fe3906786ec5452957be4405ca2502e65f21e02290dc8d2a3d1
                                          • Opcode Fuzzy Hash: 2543abcbf31cc243ec37774c27c533e7a2c59fbfae1390a619607f6781a879b3
                                          • Instruction Fuzzy Hash: 2B21B1712012059BAF04DF99EDA8759B3A9EF8222531A5195E925CF2C5CF70EC06CBA2
                                          Function 6A63E120 Relevance: 6.1, APIs: 4, Instructions: 71COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6404B0: ?detach_helper@QHashData@@QAEPAU1@P6AXPAUNode@1@PAX@ZP6AX0@ZHH@Z.QT5CORE(6A6406B0,6A6403D0,00000034,00000004,?,?,6A63E12B), ref: 6A6404D2
                                            • Part of subcall function 6A6404B0: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A6403D0,?,?,6A63E12B), ref: 6A6404FF
                                          • ?qHash@@YAIABVQString@@I@Z.QT5CORE(?,?), ref: 6A63E135
                                            • Part of subcall function 6A6163C0: ??8@YA_NABVQString@@0@Z.QT5CORE(6BB6BFD0,?,?,?,6BB6BFD0,?,6A6660C1,?,00000000), ref: 6A6163FA
                                          • ?rehash@QHashData@@QAEXH@Z.QT5CORE(?,?,00000000), ref: 6A63E16A
                                          • ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000004,?,00000000), ref: 6A63E17F
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A63E197
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@Hash$??8@?allocate?detach_helper@?free_helper@?rehash@Array@@ByteHash@@Node@Node@1@Node@1@@String@@String@@0@V0@@
                                          • String ID:
                                          • API String ID: 3605310116-0
                                          • Opcode ID: fc3e9fb9f0b60152b63fd4a20831aed69ed7065294b7d464a6d0478e52966e07
                                          • Instruction ID: 140c293205b70918aa5db84654c83fd8962aa8bc64e03eec540a8f24a279b347
                                          • Opcode Fuzzy Hash: fc3e9fb9f0b60152b63fd4a20831aed69ed7065294b7d464a6d0478e52966e07
                                          • Instruction Fuzzy Hash: D82139B11002119FC704CF55C898B5BBBF9FF45365F12845AE50A8B352CB76DD4ACBA0
                                          Function 6A622A00 Relevance: 6.1, APIs: 4, Instructions: 66COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isValid@QVariant@@QBE_NXZ.QT5CORE(?,00000001,6A6596D5,00000003,?), ref: 6A622A11
                                          • ??1QVariant@@QAE@XZ.QT5CORE(6BBE0EA0,?,00000000,6BB6C190), ref: 6A622A85
                                          • ?freeNode@QHashData@@QAEXPAX@Z.QT5CORE(?), ref: 6A622A8E
                                          • ?hasShrunk@QHashData@@QAEXXZ.QT5CORE ref: 6A622AA5
                                            • Part of subcall function 6A620850: ?rehash@QHashData@@QAEXH@Z.QT5CORE(?,?,?,?,00000000,?,?,6A6224B6,?,?,?), ref: 6A620888
                                            • Part of subcall function 6A620850: ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000008,?,?,?,00000000,?,?,6A6224B6,?,?,?), ref: 6A6208A2
                                            • Part of subcall function 6A620850: ??0QVariant@@QAE@ABV0@@Z.QT5CORE(?,?,00000000,?,?,6A6224B6,?,?,?), ref: 6A6208C2
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@Hash$Variant@@$Node@$?allocate?free?has?rehash@Shrunk@V0@@Valid@
                                          • String ID:
                                          • API String ID: 4192571733-0
                                          • Opcode ID: 9492df51a463fdadd9d07a98c0c68cc2473d30d8a7f58b16ba92e76937091286
                                          • Instruction ID: 3fdafa77d8220d4c525df3b1a328be85d2d76f4ef831e8e134ea923186334b7e
                                          • Opcode Fuzzy Hash: 9492df51a463fdadd9d07a98c0c68cc2473d30d8a7f58b16ba92e76937091286
                                          • Instruction Fuzzy Hash: C5219A312142419FDB10DF65C488A9BFBF9FF99314F02885AE89697641CB30ED48CFA2
                                          Function 6A620850 Relevance: 6.1, APIs: 4, Instructions: 66COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A61A800: ?detach_helper@QHashData@@QAEPAU1@P6AXPAUNode@1@PAX@ZP6AX0@ZHH@Z.QT5CORE(6A61A860,6A61A7F0,00000020,00000008,00000000,00000001,6A6200E5,?), ref: 6A61A822
                                            • Part of subcall function 6A61A800: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A61A7F0), ref: 6A61A84F
                                          • ?rehash@QHashData@@QAEXH@Z.QT5CORE(?,?,?,?,00000000,?,?,6A6224B6,?,?,?), ref: 6A620888
                                          • ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000008,?,?,?,00000000,?,?,6A6224B6,?,?,?), ref: 6A6208A2
                                          • ??0QVariant@@QAE@ABV0@@Z.QT5CORE(?,?,00000000,?,?,6A6224B6,?,?,?), ref: 6A6208C2
                                          • ??4QVariant@@QAEAAV0@ABV0@@Z.QT5CORE(?,?,?,?,00000000,?,?,6A6224B6,?,?,?), ref: 6A6208E4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@Hash$V0@@Variant@@$?allocate?detach_helper@?free_helper@?rehash@Node@Node@1@Node@1@@
                                          • String ID:
                                          • API String ID: 1975562825-0
                                          • Opcode ID: 7c07188c090fc4ae282965be6c492d59da8e5b72722acdcc7b809b5d633c3dba
                                          • Instruction ID: 07d041ef7967208cb5d8c78fb7ee4ff5f08684d4d0ca15faff7efb4fa929ddfe
                                          • Opcode Fuzzy Hash: 7c07188c090fc4ae282965be6c492d59da8e5b72722acdcc7b809b5d633c3dba
                                          • Instruction Fuzzy Hash: 7D2147752043049FCB14CF59C88486AFBF9FF99361B02882EF98687751DB30AC05CBA0
                                          Function 6A69E880 Relevance: 6.1, APIs: 4, Instructions: 66COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isNull@QSslKey@@QBE_NXZ.QT5NETWORK ref: 6A69E8C1
                                          • ?qHash@@YAIABVQSslCertificate@@I@Z.QT5NETWORK(?,00000000), ref: 6A69E8CD
                                            • Part of subcall function 6A6ABAD0: ?qHashBits@@YAIPBXII@Z.QT5CORE(?,?,?,?,00000000,?,?), ref: 6A6ABB17
                                          • ?isNull@QSslKey@@QBE_NXZ.QT5NETWORK ref: 6A69E8EF
                                          • ?qHash@@YAIABVQSslCertificate@@I@Z.QT5NETWORK(?,00000000), ref: 6A69E8FB
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Certificate@@Hash@@Key@@Null@$Bits@@Hash
                                          • String ID:
                                          • API String ID: 2189986890-0
                                          • Opcode ID: 3641ad2ca3a42302dbd1d1fc0491432b382a5bbcab39f45607ec277a09599a31
                                          • Instruction ID: 884d449af615151a659bf2c09bb21ce2ebcabd12dab0d3aef8032e2585e14ee1
                                          • Opcode Fuzzy Hash: 3641ad2ca3a42302dbd1d1fc0491432b382a5bbcab39f45607ec277a09599a31
                                          • Instruction Fuzzy Hash: 560166B3F0012217D71C8558DC5277AE386EBE5666F0A8238DA0BE3352EAA9CC0183D0
                                          Function 6A698AE0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,00000000,?,00000000,00000000,?,6A697D4C,?,00000000), ref: 6A698B3C
                                          • ?freeTree@QMapDataBase@@QAEXPAUQMapNodeBase@@H@Z.QT5CORE(?,00000004), ref: 6A698B76
                                          • ?freeData@QMapDataBase@@SAXPAU1@@Z.QT5CORE(?), ref: 6A698B7D
                                          • ??0QString@@QAE@XZ.QT5CORE(00000000,?,6A697D4C,?,00000000), ref: 6A698B93
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Base@@$?freeData$Array@@ByteData@NodeString@@Tree@U1@@
                                          • String ID:
                                          • API String ID: 1897305905-0
                                          • Opcode ID: 6ef16d9bedd2e98b882be90ef267fe48b4a8a7731e912e21dca55512e1fb6e0a
                                          • Instruction ID: 45faf61e41886a744a7ae99c196c4bc619e46f295eace45b6721270bf19ca558
                                          • Opcode Fuzzy Hash: 6ef16d9bedd2e98b882be90ef267fe48b4a8a7731e912e21dca55512e1fb6e0a
                                          • Instruction Fuzzy Hash: C02147B52043029FDB44CF54C844B5ABBF8FF85325F05891DF5A6832A0CB30AC44CB52
                                          Function 6A624800 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?detach@QListData@@QAEPAUData@1@H@Z.QT5CORE(?,?,?,6BB6C190,6BBE0EA0,6A65A5CE,?), ref: 6A624815
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 6A624838
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A624885
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000), ref: 6A624890
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@ByteData@@List$?detach@?dispose@Data@1@Data@1@@V0@@
                                          • String ID:
                                          • API String ID: 133044862-0
                                          • Opcode ID: a7db47fd3bb164f1dd2c8c173672f175988d4f7b75400e02072a873f110c6c2a
                                          • Instruction ID: 225f586dcccec3e701d309854748ce3ea2e0fd540e0b299d576f5b39d70480cd
                                          • Opcode Fuzzy Hash: a7db47fd3bb164f1dd2c8c173672f175988d4f7b75400e02072a873f110c6c2a
                                          • Instruction Fuzzy Hash: D411C1B29001258BEB109F5CC888669B3B5FF81334B1B4261DD7AAB342DB71FD55CAD1
                                          Function 6A628B70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??M@YA_NABVQStringRef@@0@Z.QT5CORE(6BB6C204,071C71C7,?), ref: 6A628B91
                                          • ??M@YA_NABVQStringRef@@0@Z.QT5CORE(6BB6C204,?), ref: 6A628BBC
                                          • ??M@YA_NABVQStringRef@@0@Z.QT5CORE(00000000,071C71C7), ref: 6A628BEE
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Ref@@0@String
                                          • String ID:
                                          • API String ID: 3339499332-0
                                          • Opcode ID: 2a8084c396aefb64dec7752a51dcd75f0d9995da9ad8a1f8b783ac0a92300e64
                                          • Instruction ID: 5bb2aad23c15fe89d82ec693708ec3c4a8865bef74c50519897f305109e4fd01
                                          • Opcode Fuzzy Hash: 2a8084c396aefb64dec7752a51dcd75f0d9995da9ad8a1f8b783ac0a92300e64
                                          • Instruction Fuzzy Hash: 4E113DB58002009FD740EF18CD45A57B7F8BF95305F45C45DE9498B211E736EA198FD2
                                          Function 6A6448B0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6448CF
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6448D8
                                            • Part of subcall function 6A61F950: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A61A7F0,00000001,00000001,6A6201BD), ref: 6A61F99C
                                            • Part of subcall function 6A61F950: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(6A61A7F0), ref: 6A61F9C8
                                            • Part of subcall function 6A61F950: ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000001,?,?), ref: 6A61FA05
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A644907
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A644910
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$Data@@$?free_helper@HashNode@1@@$?dispose@Data@1@@List
                                          • String ID:
                                          • API String ID: 919546588-0
                                          • Opcode ID: 75803ae9347fe25af39ac74b4d27dd0ae936b7a100a6f4a43d3679c5298e0fce
                                          • Instruction ID: 1749c97af1323b709fa5d0d1d10e60c66074ae2b1caa06747d1e4c67368afa96
                                          • Opcode Fuzzy Hash: 75803ae9347fe25af39ac74b4d27dd0ae936b7a100a6f4a43d3679c5298e0fce
                                          • Instruction Fuzzy Hash: 0A01FC31111A039BC3209F69CCA9755B7B8FF21312B02462DE4A3930A0EF30BC05CBC0
                                          Function 6A6BE2B5 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2BD
                                          • malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • _CxxThrowException.VCRUNTIME140(?,6A6DEF0C), ref: 6A6BF0A4
                                          • _CxxThrowException.VCRUNTIME140(?,6A6DE7F8), ref: 6A6BF0C1
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ExceptionThrow$_callnewhmalloc
                                          • String ID:
                                          • API String ID: 4113974480-0
                                          • Opcode ID: 880900bf987af1f9cdbb45395f5b226b1f3c1b42569e930c1ae64482f9d75080
                                          • Instruction ID: 1e630333cd887ecb189e689b871fee3129f9b7464c1dad729710d40d94dbce28
                                          • Opcode Fuzzy Hash: 880900bf987af1f9cdbb45395f5b226b1f3c1b42569e930c1ae64482f9d75080
                                          • Instruction Fuzzy Hash: 70F0BE3880020DB6DB10AAB8EC5C9ADB7AC9E02254B5142B0ED34954F1FF31EA35C3D8
                                          Function 6A64E030 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setSslConfiguration@QSslSocket@@QAEXABVQSslConfiguration@@@Z.QT5NETWORK(?,00000000,?,6A649EDB,?), ref: 6A64E040
                                            • Part of subcall function 6A69D310: ?localCertificateChain@QSslConfiguration@@QBE?AV?$QList@VQSslCertificate@@@@XZ.QT5NETWORK(?), ref: 6A69D325
                                            • Part of subcall function 6A69D310: ?privateKey@QSslConfiguration@@QBE?AVQSslKey@@XZ.QT5NETWORK(?), ref: 6A69D35D
                                            • Part of subcall function 6A69D310: ??4QSslKey@@QAEAAV0@$$QAV0@@Z.QT5NETWORK(00000000), ref: 6A69D369
                                            • Part of subcall function 6A69D310: ??1QSslKey@@QAE@XZ.QT5NETWORK ref: 6A69D372
                                            • Part of subcall function 6A69D310: ?ciphers@QSslConfiguration@@QBE?AV?$QList@VQSslCipher@@@@XZ.QT5NETWORK(?), ref: 6A69D37E
                                            • Part of subcall function 6A69D310: ?ellipticCurves@QSslConfiguration@@QBE?AV?$QVector@VQSslEllipticCurve@@@@XZ.QT5NETWORK(?), ref: 6A69D3B6
                                            • Part of subcall function 6A69D310: ?sharedNull@QArrayData@@SAPAU1@XZ.QT5CORE ref: 6A69D3BF
                                            • Part of subcall function 6A69D310: ?deallocate@QArrayData@@SAXPAU1@II@Z.QT5CORE(?,00000004,00000004), ref: 6A69D3F8
                                            • Part of subcall function 6A69D310: ?deallocate@QArrayData@@SAXPAU1@II@Z.QT5CORE(?,00000004,00000004), ref: 6A69D425
                                            • Part of subcall function 6A69D310: ?preSharedKeyIdentityHint@QSslConfiguration@@QBE?AVQByteArray@@XZ.QT5NETWORK(?), ref: 6A69D431
                                            • Part of subcall function 6A69D310: ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000), ref: 6A69D43D
                                            • Part of subcall function 6A69D310: ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A69D447
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??4QSslConfiguration@@QAEAAV0@ABV0@@Z.QT5NETWORK(?,00000000,?,6A649EDB,?), ref: 6A64E04D
                                          • ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A64E064
                                          • ??1QSslConfiguration@@QAE@XZ.QT5NETWORK(?), ref: 6A64E079
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Configuration@@$V0@@$ArrayData@@Key@@$?deallocate@Array@@ByteList@SharedV0@$$$?ciphers@?elliptic?local?pre?private?set?sharedAuthenticator@@CertificateCertificate@@@@Chain@Cipher@@@@Configuration@Configuration@@@Curve@@@@Curves@DateEllipticHint@IdentityKey@Null@Socket@@Time@@Vector@malloc
                                          • String ID:
                                          • API String ID: 3108088317-0
                                          • Opcode ID: b6c592b6f7b0a347db9e7c096ed709bbc594c6c67da8daa7bfc829c057566842
                                          • Instruction ID: a7bbaf096e9474b3ab572d431ee0baa9b631f6aea3339864584f15b2ea340bb9
                                          • Opcode Fuzzy Hash: b6c592b6f7b0a347db9e7c096ed709bbc594c6c67da8daa7bfc829c057566842
                                          • Instruction Fuzzy Hash: A6F0E972B0292267D704D6559404ABE67599F92E15B07403AE62557180DF30EC2183ED
                                          Function 6A618340 Relevance: 6.0, APIs: 4, Instructions: 34networkCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QBuffer@@QAE@PAVQObject@@@Z.QT5CORE(00000000), ref: 6A618354
                                          • ?setData@QBuffer@@QAEXABVQByteArray@@@Z.QT5CORE(?), ref: 6A618366
                                          • ?sendCustomRequest@QNetworkAccessManager@@QAEPAVQNetworkReply@@ABVQNetworkRequest@@ABVQByteArray@@PAVQIODevice@@@Z.QT5NETWORK(?,?,00000000), ref: 6A618389
                                            • Part of subcall function 6A6183F0: ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(?,00000000,?,?,?,00000000), ref: 6A6183FF
                                            • Part of subcall function 6A6183F0: ??0QVariant@@QAE@ABVQByteArray@@@Z.QT5CORE(?,?,00000000,?,?,?,00000000), ref: 6A61840C
                                            • Part of subcall function 6A6183F0: ?setAttribute@QNetworkRequest@@QAEXW4Attribute@1@ABVQVariant@@@Z.QT5NETWORK(0000000A,?,?,?,?,00000000), ref: 6A61841D
                                            • Part of subcall function 6A6183F0: ??1QVariant@@QAE@XZ.QT5CORE(0000000A,?,?,?,?,00000000), ref: 6A618426
                                            • Part of subcall function 6A6183F0: ??1QNetworkRequest@@QAE@XZ.QT5NETWORK(00000000,?,?,?,00000000), ref: 6A61844F
                                          • ?setParent@QObject@@QAEXPAV1@@Z.QT5CORE(00000000,?,?,00000000), ref: 6A618393
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Network$?setByteRequest@@$Array@@@Buffer@@Variant@@$?sendAccessArray@@Attribute@Attribute@1@Authenticator@@CustomData@Device@@@Manager@@Object@@Object@@@Parent@Reply@@Request@SharedV0@@V1@@Variant@@@malloc
                                          • String ID:
                                          • API String ID: 3743085974-0
                                          • Opcode ID: e74a2c22c348529d0d1871974341cd1d96be7a83987f0d0bc3d09ad723caa2da
                                          • Instruction ID: a37e7c3377f1a208cb75961d08f997e5b2cb73b3811ed8ee92c3a2371ef6b0ce
                                          • Opcode Fuzzy Hash: e74a2c22c348529d0d1871974341cd1d96be7a83987f0d0bc3d09ad723caa2da
                                          • Instruction Fuzzy Hash: 2DF017B13041119FDB149BAA9818A5FBFA6EFDAB10F1A0019F40687390DB719C15CBA2
                                          Function 6A69EB30 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                            • Part of subcall function 6A6B5370: ??0QString@@QAE@XZ.QT5CORE(?,00000000,6A69EB49), ref: 6A6B5385
                                            • Part of subcall function 6A6B5370: ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000,6A69EB49), ref: 6A6B53B0
                                            • Part of subcall function 6A6B5370: ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6B53BA
                                          • ??0QObject@@IAE@AAVQObjectPrivate@@PAV0@@Z.QT5CORE(00000000,?), ref: 6A69EB50
                                          • ?defaultDtlsConfiguration@QSslConfiguration@@SA?AV1@XZ.QT5NETWORK ref: 6A69EB6E
                                          • ?setPeerVerifyMode@QSslConfiguration@@QAEXW4PeerVerifyMode@QSslSocket@@@Z.QT5NETWORK(00000000,?), ref: 6A69EB7C
                                            • Part of subcall function 6A69F270: ?localCertificateChain@QSslConfiguration@@QBE?AV?$QList@VQSslCertificate@@@@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,6A69EB1C,00000000), ref: 6A69F284
                                            • Part of subcall function 6A69F270: ?privateKey@QSslConfiguration@@QBE?AVQSslKey@@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,6A69EB1C,00000000), ref: 6A69F2B6
                                            • Part of subcall function 6A69F270: ??4QSslKey@@QAEAAV0@$$QAV0@@Z.QT5NETWORK(00000000,?,?,?,?,?,?,?,?,?,?,6A69EB1C,00000000), ref: 6A69F2BF
                                            • Part of subcall function 6A69F270: ??1QSslKey@@QAE@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,6A69EB1C,00000000), ref: 6A69F2C8
                                            • Part of subcall function 6A69F270: ?ciphers@QSslConfiguration@@QBE?AV?$QList@VQSslCipher@@@@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,6A69EB1C,00000000), ref: 6A69F2D4
                                            • Part of subcall function 6A69F270: ?ellipticCurves@QSslConfiguration@@QBE?AV?$QVector@VQSslEllipticCurve@@@@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,6A69EB1C,00000000), ref: 6A69F306
                                            • Part of subcall function 6A69F270: ?sharedNull@QArrayData@@SAPAU1@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,6A69EB1C,00000000), ref: 6A69F30F
                                            • Part of subcall function 6A69F270: ?deallocate@QArrayData@@SAXPAU1@II@Z.QT5CORE(?,00000004,00000004,?,?,?,?,?,?,?,?,?,?,6A69EB1C,00000000), ref: 6A69F342
                                            • Part of subcall function 6A69F270: ?deallocate@QArrayData@@SAXPAU1@II@Z.QT5CORE(?,00000004,00000004,?,?,?,?,?,?,?,?,?,6A69EB1C,00000000), ref: 6A69F36F
                                            • Part of subcall function 6A69F270: ?preSharedKeyIdentityHint@QSslConfiguration@@QBE?AVQByteArray@@XZ.QT5NETWORK(?,?,?,?,?,?,?,?,?,?,?,?,?,6A69EB1C,00000000), ref: 6A69F37B
                                            • Part of subcall function 6A69F270: ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6A69EB1C,00000000), ref: 6A69F387
                                            • Part of subcall function 6A69F270: ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,6A69EB1C,00000000), ref: 6A69F391
                                          • ??1QSslConfiguration@@QAE@XZ.QT5NETWORK(?,?), ref: 6A69EB91
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Configuration@@$V0@@$ArrayArray@@ByteData@@Key@@V0@$$$?deallocate@DateList@Mode@PeerTime@@Verify$?ciphers@?default?elliptic?local?pre?private?set?sharedCertificateCertificate@@@@Chain@Cipher@@@@Configuration@Curve@@@@Curves@DtlsEllipticHint@IdentityKey@Null@ObjectObject@@Private@@SharedSocket@@@String@@Vector@malloc
                                          • String ID:
                                          • API String ID: 2392938248-0
                                          • Opcode ID: 2b66711d1d746778a5f06bbcdf0e10b59a5354af2eab8ca59dc202c4ebbe4e18
                                          • Instruction ID: b1d2529b72a2ff89ba0c11367ddc831db69f239124fde00793dc7825a40e6f30
                                          • Opcode Fuzzy Hash: 2b66711d1d746778a5f06bbcdf0e10b59a5354af2eab8ca59dc202c4ebbe4e18
                                          • Instruction Fuzzy Hash: 69F090B56003026BCA04DB70C80CA5FBFA99FC0355F05042CF54A83291EF70E858C7A6
                                          Function 6A61A060 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?lock@QMutex@@QAEXXZ.QT5CORE(?,?,6A702504,6A6BFA9A), ref: 6A61A072
                                          • ?unlock@QMutexLocker@@QAEXXZ.QT5CORE(?,?,6A702504,6A6BFA9A), ref: 6A61A088
                                          • ??1QRecursiveMutex@@QAE@XZ.QT5CORE(?,?,6A702504,6A6BFA9A), ref: 6A61A090
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(6A702504,?,?,6A702504,6A6BFA9A), ref: 6A61A0B3
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Mutex@@$?dispose@?lock@?unlock@Data@1@@Data@@ListLocker@@MutexRecursive
                                          • String ID:
                                          • API String ID: 1770302048-0
                                          • Opcode ID: 28e9d6d758d405d754d8fada32492a3e869ec08e2464fbfb757972209487f79d
                                          • Instruction ID: 97b50d27c295fedbbbcb2071ef33f5d1cd21e3a6bb52c387f6e6fe8a3251e9f6
                                          • Opcode Fuzzy Hash: 28e9d6d758d405d754d8fada32492a3e869ec08e2464fbfb757972209487f79d
                                          • Instruction Fuzzy Hash: 23F096751061129F9B055B29C844559BFB0FF85776722421EE877C32E0DF31AC5ACA91
                                          Function 6A698BD0 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                          • ??0QString@@QAE@XZ.QT5CORE(00000000,00000000,?,6A6B2E75,00000000,000000FF), ref: 6A698BE8
                                          • ??0QSslCertificate@@QAE@ABVQByteArray@@W4EncodingFormat@QSsl@@@Z.QT5NETWORK(00000000,?,6A6B2E75,00000000,000000FF), ref: 6A698BF2
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(00000000,?,6A6B2E75,00000000,000000FF), ref: 6A698BFB
                                          • ??4QSslCertificate@@QAEAAV0@ABV0@@Z.QT5NETWORK(?,?,6A6B2E75,00000000,000000FF), ref: 6A698C14
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@ByteCertificate@@$EncodingFormat@Ssl@@@String@@V0@@malloc
                                          • String ID:
                                          • API String ID: 672309116-0
                                          • Opcode ID: b478433505d3d60c0d610c27c366a441bc80da0316c2fb09a374c5e94303f893
                                          • Instruction ID: 9e6c3b6447133f6167f2fea19c3951d3b7f58297cacc1bc14d2a269d05a5235f
                                          • Opcode Fuzzy Hash: b478433505d3d60c0d610c27c366a441bc80da0316c2fb09a374c5e94303f893
                                          • Instruction Fuzzy Hash: 58F03AB62402029FD314DF24D888E97BBA8FB59614F01852EE55BC7280EF30A848CBA1
                                          Function 6A696200 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QString@@QAE@XZ.QT5CORE(00000000), ref: 6A696215
                                          • ??0QSslCertificate@@QAE@ABVQByteArray@@W4EncodingFormat@QSsl@@@Z.QT5NETWORK(00000000), ref: 6A696220
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(00000000), ref: 6A696229
                                          • ??0QSslCertificate@@QAE@ABV0@@Z.QT5NETWORK(?), ref: 6A696243
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@ByteCertificate@@$EncodingFormat@Ssl@@@String@@V0@@
                                          • String ID:
                                          • API String ID: 1921671265-0
                                          • Opcode ID: 29d19cf11e2d79341e54639ca19225ecd0e1a4d73fc8c2c3c1a746107644402e
                                          • Instruction ID: 2f9324443d4253e0e4e88e489f09b9e5f8dc247063f9f26a88971974364104b0
                                          • Opcode Fuzzy Hash: 29d19cf11e2d79341e54639ca19225ecd0e1a4d73fc8c2c3c1a746107644402e
                                          • Instruction Fuzzy Hash: 1EF0F8752142019FC708DB58D898E9AF7E8EF98321F06C82EF55AC72A2CF30E854CB55
                                          Function 6A69EAD0 Relevance: 6.0, APIs: 4, Instructions: 27COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6A6BE2B5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6A612CA1,000000BC,?,?,?,?,?,6A6115D7,00000000), ref: 6A6BE2CA
                                            • Part of subcall function 6A6B53D0: ?sharedNull@QArrayData@@SAPAU1@XZ.QT5CORE ref: 6A6B53E9
                                            • Part of subcall function 6A6B53D0: ?sharedNull@QArrayData@@SAPAU1@XZ.QT5CORE ref: 6A6B53F5
                                            • Part of subcall function 6A6B53D0: ?sharedNull@QArrayData@@SAPAU1@XZ.QT5CORE ref: 6A6B540E
                                            • Part of subcall function 6A6B53D0: ??0QSslPreSharedKeyAuthenticator@@QAE@XZ.QT5NETWORK ref: 6A6B543C
                                            • Part of subcall function 6A6B53D0: ??0QString@@QAE@XZ.QT5CORE ref: 6A6B5447
                                            • Part of subcall function 6A6B53D0: ??4QDateTime@@QAEAAV0@$$QAV0@@Z.QT5CORE(00000000,6A69EAE7), ref: 6A6B5461
                                            • Part of subcall function 6A6B53D0: ??1QByteArray@@QAE@XZ.QT5CORE ref: 6A6B546B
                                          • ??0QObject@@IAE@AAVQObjectPrivate@@PAV0@@Z.QT5CORE(00000000,?), ref: 6A69EAEE
                                          • ?defaultDtlsConfiguration@QSslConfiguration@@SA?AV1@XZ.QT5NETWORK(?), ref: 6A69EB0C
                                          • ?setDtlsConfiguration@QDtls@@QAE_NABVQSslConfiguration@@@Z.QT5NETWORK(00000000), ref: 6A69EB17
                                            • Part of subcall function 6A69F620: ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z.QT5CORE(?,Cannot set configuration after handshake started,00000000,000000FF), ref: 6A69F640
                                            • Part of subcall function 6A69F620: ??4QString@@QAEAAV0@ABV0@@Z.QT5CORE(6A69EB1C), ref: 6A69F652
                                            • Part of subcall function 6A69F620: ??1QString@@QAE@XZ.QT5CORE ref: 6A69F65C
                                          • ??1QSslConfiguration@@QAE@XZ.QT5NETWORK(00000000), ref: 6A69EB20
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$?sharedArrayData@@Null@V0@@$Configuration@Configuration@@DtlsObject@@$?default?set?tr@Array@@Authenticator@@ByteConfiguration@@@DateDtls@@MetaObjectPrivate@@SharedTime@@V0@$$malloc
                                          • String ID:
                                          • API String ID: 2128072664-0
                                          • Opcode ID: b7b822c2f29003f594feab13fcaacb577f4d5d05f6ce2c10cd1318c8b6b55bc5
                                          • Instruction ID: 1725d20e6426bfe2c211d18bce3f05d847f47d2c45ee58c44e571a2aecb9f95d
                                          • Opcode Fuzzy Hash: b7b822c2f29003f594feab13fcaacb577f4d5d05f6ce2c10cd1318c8b6b55bc5
                                          • Instruction Fuzzy Hash: E0F065B5A003116BCB149B70D80C99FBFA99F85664F05482DF48A8B381EF75EC14C796
                                          Function 6A61A0C0 Relevance: 6.0, APIs: 4, Instructions: 14networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??1QRecursiveMutex@@QAE@XZ.QT5CORE ref: 6A61A0CC
                                          • ??1QNetworkConfiguration@@QAE@XZ.QT5NETWORK ref: 6A61A0D5
                                            • Part of subcall function 6A661870: ??1QString@@QAE@XZ.QT5CORE(?,6A663BB2,?,?,?,00000064,00000000), ref: 6A661889
                                            • Part of subcall function 6A661870: ??1QString@@QAE@XZ.QT5CORE(?,?,00000064,00000000), ref: 6A661892
                                            • Part of subcall function 6A661870: ??1QRecursiveMutex@@QAE@XZ.QT5CORE(?,?,00000064,00000000), ref: 6A66189B
                                          • ??1QNetworkConfiguration@@QAE@XZ.QT5NETWORK ref: 6A61A0DD
                                          • ??1QNetworkConfiguration@@QAE@XZ.QT5NETWORK ref: 6A61A0E5
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Configuration@@Network$Mutex@@RecursiveString@@
                                          • String ID:
                                          • API String ID: 1194525769-0
                                          • Opcode ID: 552b4f5e3ac3041c5a5fe36a34e7626d7e1206eeb1cc690a44fb594a613146cf
                                          • Instruction ID: d1bc5c5c7553446207baba198e5e55ab4434ed082c8ed96702c13553884b3dd9
                                          • Opcode Fuzzy Hash: 552b4f5e3ac3041c5a5fe36a34e7626d7e1206eeb1cc690a44fb594a613146cf
                                          • Instruction Fuzzy Hash: 4BD017302106118BC728EF20D45489AF3B8BF16245316592EC18383990EF30B908CBA2
                                          Function 6A69C390 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?read@QIODevice@@QAE_JPAD_J@Z.QT5CORE(?,?,?), ref: 6A69C3C7
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(?,_q_flushReadBuffer,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6A69C41A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: GenericObject@@$?invoke?read@Argument@@Argument@@444444444@ConnectionDevice@@MetaMethod@Qt@@ReturnType@
                                          • String ID: _q_flushReadBuffer
                                          • API String ID: 3526229224-931563490
                                          • Opcode ID: 0ab5e70c4ba3665fb5ad94bb01d2b80ef89229f61aeef0b5c1875670d40fb8ce
                                          • Instruction ID: a33f530281d38c80239ec3c823548511a86f483f0abdb49d724b519ccc3dc200
                                          • Opcode Fuzzy Hash: 0ab5e70c4ba3665fb5ad94bb01d2b80ef89229f61aeef0b5c1875670d40fb8ce
                                          • Instruction Fuzzy Hash: CB118235604302DFC710DA68E880F9BBBF1AFD5721F10C62EF5A552250EB71A499CBA1
                                          Function 6A642920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?write@QIODevice@@QAE_JPBD_J@Z.QT5CORE(PRI * HTTP/2.0SMqt.network.http2,00000018,00000000,?,00000000), ref: 6A64293E
                                            • Part of subcall function 6A648210: ??0QSslPreSharedKeyAuthenticator@@QAE@ABV0@@Z.QT5NETWORK(-00000088,6A63DBCE,?,?), ref: 6A64821D
                                            • Part of subcall function 6A63C9E0: ?serverPushEnabled@QHttp2Configuration@@QBE_NXZ.QT5NETWORK(?,?,6BB48650,?), ref: 6A63CA20
                                            • Part of subcall function 6A63C9E0: ?timeToLive@QDnsTextRecord@@QBEIXZ.QT5NETWORK(?,?,6BB48650,?), ref: 6A63CA60
                                            • Part of subcall function 6A63C9E0: ?usedBits@QSslCipher@@QBEHXZ.QT5NETWORK(?,?,6BB48650,?), ref: 6A63CA80
                                            • Part of subcall function 6A63C9E0: ?usedBits@QSslCipher@@QBEHXZ.QT5NETWORK(?,?,6BB48650,?), ref: 6A63CAAB
                                          • ??1QHttp2Configuration@@QAE@XZ.QT5NETWORK(?), ref: 6A642989
                                            • Part of subcall function 6A63C2C0: ?write@QIODevice@@QAE_JPBD_J@Z.QT5CORE(?,?,00000000), ref: 6A63C2D2
                                          Strings
                                          • PRI * HTTP/2.0SMqt.network.http2, xrefs: 6A642939
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?used?write@Bits@Cipher@@Configuration@@Device@@Http2$?server?timeAuthenticator@@Enabled@Live@PushRecord@@SharedTextV0@@
                                          • String ID: PRI * HTTP/2.0SMqt.network.http2
                                          • API String ID: 1466809049-81387864
                                          • Opcode ID: ccdbf3bf20881541b3faf82788251d5f0a9245364117e642fc68f2abf48c10d1
                                          • Instruction ID: 252dc92237151ce19fd3e4b56af7007be6f6d6699509b3574b04ee5613f8c996
                                          • Opcode Fuzzy Hash: ccdbf3bf20881541b3faf82788251d5f0a9245364117e642fc68f2abf48c10d1
                                          • Instruction Fuzzy Hash: CF21BD325007119AC721DF60C844BEB73E8EF89304F51895DE99A82092EF31B50EDBA5
                                          Function 6A656390 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?state@QNetworkSession@@QBE?AW4State@1@XZ.QT5NETWORK(?), ref: 6A6563B2
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(?,_q_startOperation,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6A65640C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: GenericObject@@$?invoke?state@Argument@@Argument@@444444444@ConnectionMetaMethod@NetworkQt@@ReturnSession@@State@1@Type@
                                          • String ID: _q_startOperation
                                          • API String ID: 3002949114-2504287645
                                          • Opcode ID: dd76d8f4148b6cc8179a7fa4a57e99e5edb551f7f298ff24bdd2eb97db9197b6
                                          • Instruction ID: 03b10a3de9a5b8f1598c66df6734d762d5236d33987f3207eadc8d37d541aef6
                                          • Opcode Fuzzy Hash: dd76d8f4148b6cc8179a7fa4a57e99e5edb551f7f298ff24bdd2eb97db9197b6
                                          • Instruction Fuzzy Hash: DC01243964560057C6349E59CC41B8B33A0AF81B21F0EC46DE9AB932C0FF70E821C797
                                          Function 6A6BC340 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: QAbstractProtocolHandler$QSpdyProtocolHandler
                                          • API String ID: 0-1651654507
                                          • Opcode ID: cfdc0cb41df31fd00e42b9bfe59c6717c9c10a133827bdac5094193bdc162e47
                                          • Instruction ID: 089b0579391b0a35ffeaa32082924fea809e9220de1e60a312d63dfc5139966f
                                          • Opcode Fuzzy Hash: cfdc0cb41df31fd00e42b9bfe59c6717c9c10a133827bdac5094193bdc162e47
                                          • Instruction Fuzzy Hash: D1110C5330C1500683914A785851AE7ABB79FAB2683CD44B7C5C3CB291DE33FA19C3A0
                                          Function 6A6BE828 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                          • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 6A6BF48D
                                          • ___raise_securityfailure.LIBCMT ref: 6A6BF574
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: FeaturePresentProcessor___raise_securityfailure
                                          • String ID: 5pjp5pj
                                          • API String ID: 3761405300-1969759152
                                          • Opcode ID: 63735c618dec9cb589a58b1265c339ff19abca7a573f8e36f4f9988c2fbd9275
                                          • Instruction ID: b74fabc2a8f3c6edb4e06ea01a172ad5bfa373f098748cd5f554daa878b52d4a
                                          • Opcode Fuzzy Hash: 63735c618dec9cb589a58b1265c339ff19abca7a573f8e36f4f9988c2fbd9275
                                          • Instruction Fuzzy Hash: A121CFF9501200AADB10DF29E5A6E45FBE4BB0A314F10913EE904CB3A1EFB49D818F49
                                          Function 6A68A8D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?state@QAbstractSocket@@QBE?AW4SocketState@1@XZ.QT5NETWORK ref: 6A68A8EA
                                          • ?invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@VQGenericReturnArgument@@VQGenericArgument@@444444444@Z.QT5CORE(?,writeNotification,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6A68A928
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: GenericObject@@$?invoke?state@AbstractArgument@@Argument@@444444444@ConnectionMetaMethod@Qt@@ReturnSocketSocket@@State@1@Type@
                                          • String ID: writeNotification
                                          • API String ID: 2080797201-3723278653
                                          • Opcode ID: 9198ef4582dbbe95dd573ae464a45de1e8437442e672639756a6185e715e316c
                                          • Instruction ID: 810d8a50376f3fad55d9d5c3cde1ad2be48d9adbdda62ffc6413bcf97e2fda3a
                                          • Opcode Fuzzy Hash: 9198ef4582dbbe95dd573ae464a45de1e8437442e672639756a6185e715e316c
                                          • Instruction Fuzzy Hash: 23E07DB104C20066CF2086244800B4937F45F22708F3780EDE9C65B1D3CE21DC43C765
                                          Function 6A648340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000,?), ref: 6A64836F
                                          • ?fatal@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,Called with unknown socket object.), ref: 6A64837B
                                          Strings
                                          • Called with unknown socket object., xrefs: 6A648375
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?fatal@
                                          • String ID: Called with unknown socket object.
                                          • API String ID: 1376285714-1859977836
                                          • Opcode ID: e9c1e2b6c7998629208c24a990d16f9c933b47230f9b6607169355910ab1dff2
                                          • Instruction ID: 9252cfc1f1b7291864d8fe8fe1ba2ff52579e3a4071ba73a4e80752a92cd3298
                                          • Opcode Fuzzy Hash: e9c1e2b6c7998629208c24a990d16f9c933b47230f9b6607169355910ab1dff2
                                          • Instruction Fuzzy Hash: A9F0ECB16102104FDB14EA5CCC05B5B7361FF80705F568475E652DB291EE31E815C6FA
                                          Function 6A6902F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A690309
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QLocalSocket::setServerName() called while not in unconnected state), ref: 6A690315
                                          Strings
                                          • QLocalSocket::setServerName() called while not in unconnected state, xrefs: 6A69030F
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?warning@
                                          • String ID: QLocalSocket::setServerName() called while not in unconnected state
                                          • API String ID: 3543197520-563039467
                                          • Opcode ID: d2dc620de6f9713b4d53be19db0018f1adb9ea2280cf1b7effe6cc31e565cb30
                                          • Instruction ID: a972c79098bde728effc5a85038d26535fb13fa6e5ff1b2c5c063ee7063b8002
                                          • Opcode Fuzzy Hash: d2dc620de6f9713b4d53be19db0018f1adb9ea2280cf1b7effe6cc31e565cb30
                                          • Instruction Fuzzy Hash: 97E0CDF1800100AFDB04A628CC0AB153670BB11306F674078E20B441C2EE72B515C667
                                          Function 6A68A300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000), ref: 6A68A30C
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,Operation is not supported), ref: 6A68A318
                                          Strings
                                          • Operation is not supported, xrefs: 6A68A312
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?warning@
                                          • String ID: Operation is not supported
                                          • API String ID: 3543197520-2922255152
                                          • Opcode ID: 7a74915cc591bd5ee4b2c384105f2bd78edf4bf3bdbfb47c1c789919792ac6f8
                                          • Instruction ID: a89e58b0f5491522828ff8589bef932c91abac26c950a2ff5e1e6eb31f48750c
                                          • Opcode Fuzzy Hash: 7a74915cc591bd5ee4b2c384105f2bd78edf4bf3bdbfb47c1c789919792ac6f8
                                          • Instruction Fuzzy Hash: 1DC08CB0580200B7DF10BBA48D0EF053BF4AB0AB02FE20480F613D90C1AEA4B2088623
                                          Function 6A692830 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(00000000,00000000,00000000,?,?,6A6909C5,?), ref: 6A69283C
                                          • ?warning@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000,QLocalServer::listen(qintptr) is not supported on Windows QTBUG-24230,?,?,6A6909C5,?), ref: 6A692848
                                          Strings
                                          • QLocalServer::listen(qintptr) is not supported on Windows QTBUG-24230, xrefs: 6A692842
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2593689308.000000006A611000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6A610000, based on PE: true
                                          • Associated: 00000006.00000002.2593662851.000000006A610000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593759561.000000006A6C0000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593804298.000000006A700000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593831706.000000006A701000.00000008.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593857768.000000006A702000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                          • Associated: 00000006.00000002.2593882611.000000006A704000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6a610000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Logger@@Message$?warning@
                                          • String ID: QLocalServer::listen(qintptr) is not supported on Windows QTBUG-24230
                                          • API String ID: 3543197520-1016944335
                                          • Opcode ID: 44e573e16c3018c5b1d58ab157916be42affe4b181ac51254ac7766f1e0961ae
                                          • Instruction ID: 6d4451a4e3a63acf9aa812a4f2f51ba0c579a57f60c3b76393b47289d8812218
                                          • Opcode Fuzzy Hash: 44e573e16c3018c5b1d58ab157916be42affe4b181ac51254ac7766f1e0961ae
                                          • Instruction Fuzzy Hash: 5DC080B154030077DF10B7648C0EF1637B06B29702FA10440F313D50C29D707218C637